linux-spi.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Johan Hovold <johan-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
To: Mark Brown <broonie-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
Cc: linux-spi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	Johan Hovold <johan-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
Subject: [PATCH 2/3] spi: document odd controller reference handling
Date: Sun, 29 Oct 2017 12:56:24 +0100	[thread overview]
Message-ID: <20171029115625.32385-2-johan@kernel.org> (raw)
In-Reply-To: <20171029115625.32385-1-johan-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>

Document the fact that a reference to the controller is dropped as part
of deregistration.

This is an odd pattern as the reference is typically taken in
__spi_alloc_controller() rather than spi_register_controller(). Most
controller drivers gets it right these days and notably the
device-managed interface relies on this behaviour.

Signed-off-by: Johan Hovold <johan-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
---
 drivers/spi/spi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 3ff0ee88c467..b33a727a0158 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2200,7 +2200,7 @@ static void devm_spi_unregister(struct device *dev, void *res)
  * Context: can sleep
  *
  * Register a SPI device as with spi_register_controller() which will
- * automatically be unregister
+ * automatically be unregistered and freed.
  *
  * Return: zero on success, else a negative error code.
  */
@@ -2241,6 +2241,8 @@ static int __unregister(struct device *dev, void *null)
  * only ones directly touching chip registers.
  *
  * This must be called from context that can sleep.
+ *
+ * Note that this function also drops a reference to the controller.
  */
 void spi_unregister_controller(struct spi_controller *ctlr)
 {
-- 
2.14.3

--
To unsubscribe from this list: send the line "unsubscribe linux-spi" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

  parent reply	other threads:[~2017-10-29 11:56 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-29 11:56 [PATCH 1/3] spi: fix use-after-free at controller deregistration Johan Hovold
     [not found] ` <20171029115625.32385-1-johan-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
2017-10-29 11:56   ` Johan Hovold [this message]
2017-10-31 11:22     ` Applied "spi: document odd controller reference handling" to the spi tree Mark Brown
2017-10-29 11:56 ` [PATCH 3/3] spi: spi-axi: take extra controller reference before deregistration Johan Hovold
2017-10-30  9:48   ` Lars-Peter Clausen
2017-10-30  9:57     ` Johan Hovold
     [not found]   ` <20171029115625.32385-3-johan-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
2017-10-31 11:22     ` Applied "spi: spi-axi: fix potential use-after-free after deregistration" to the spi tree Mark Brown
2017-10-31 11:22 ` Applied "spi: fix use-after-free at controller " Mark Brown

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171029115625.32385-2-johan@kernel.org \
    --to=johan-dgejt+ai2ygdnm+yrofe0a@public.gmane.org \
    --cc=broonie-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
    --cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=linux-spi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).