* [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove()
@ 2022-07-12 13:53 Yang Yingliang
2022-07-12 13:53 ` [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master() Yang Yingliang
2022-07-12 20:52 ` [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() Conor.Dooley
0 siblings, 2 replies; 6+ messages in thread
From: Yang Yingliang @ 2022-07-12 13:53 UTC (permalink / raw)
To: linux-kernel, linux-spi, linux-riscv
Cc: conor.dooley, daire.mcnamara, broonie
When using devm_spi_register_master(), the unregister function will
be called in devres_release_all() which is called after ->remove(),
so remove spi_unregister_master() andspi_master_put().
Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
drivers/spi/spi-microchip-core.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c
index b3083075cd36..c26767343176 100644
--- a/drivers/spi/spi-microchip-core.c
+++ b/drivers/spi/spi-microchip-core.c
@@ -595,8 +595,6 @@ static int mchp_corespi_remove(struct platform_device *pdev)
struct mchp_corespi *spi = spi_master_get_devdata(master);
mchp_corespi_disable_ints(spi);
- spi_unregister_master(master);
- spi_master_put(master);
clk_disable_unprepare(spi->clk);
mchp_corespi_disable(spi);
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master()
2022-07-12 13:53 [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() Yang Yingliang
@ 2022-07-12 13:53 ` Yang Yingliang
2022-07-12 14:03 ` Conor.Dooley
2022-07-12 20:52 ` [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() Conor.Dooley
1 sibling, 1 reply; 6+ messages in thread
From: Yang Yingliang @ 2022-07-12 13:53 UTC (permalink / raw)
To: linux-kernel, linux-spi, linux-riscv
Cc: conor.dooley, daire.mcnamara, broonie
Switch to use devm_spi_alloc_master() to simpify error path.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
drivers/spi/spi-microchip-core.c | 20 +++++++-------------
1 file changed, 7 insertions(+), 13 deletions(-)
diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c
index c26767343176..1a24e47f8305 100644
--- a/drivers/spi/spi-microchip-core.c
+++ b/drivers/spi/spi-microchip-core.c
@@ -513,7 +513,7 @@ static int mchp_corespi_probe(struct platform_device *pdev)
u32 num_cs;
int ret = 0;
- master = spi_alloc_master(&pdev->dev, sizeof(*spi));
+ master = devm_spi_alloc_master(&pdev->dev, sizeof(*spi));
if (!master)
return dev_err_probe(&pdev->dev, -ENOMEM,
"unable to allocate master for SPI controller\n");
@@ -535,36 +535,32 @@ static int mchp_corespi_probe(struct platform_device *pdev)
spi = spi_master_get_devdata(master);
spi->regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
- if (IS_ERR(spi->regs)) {
- ret = PTR_ERR(spi->regs);
- goto error_release_master;
- }
+ if (IS_ERR(spi->regs))
+ return PTR_ERR(spi->regs);
spi->irq = platform_get_irq(pdev, 0);
if (spi->irq <= 0) {
dev_err(&pdev->dev, "invalid IRQ %d for SPI controller\n", spi->irq);
- ret = -ENXIO;
- goto error_release_master;
+ return -ENXIO;
}
ret = devm_request_irq(&pdev->dev, spi->irq, mchp_corespi_interrupt,
IRQF_SHARED, dev_name(&pdev->dev), master);
if (ret) {
dev_err(&pdev->dev, "could not request irq: %d\n", ret);
- goto error_release_master;
+ return ret;
}
spi->clk = devm_clk_get(&pdev->dev, NULL);
if (IS_ERR(spi->clk)) {
- ret = PTR_ERR(spi->clk);
dev_err(&pdev->dev, "could not get clk: %d\n", ret);
- goto error_release_master;
+ return PTR_ERR(spi->clk);
}
ret = clk_prepare_enable(spi->clk);
if (ret) {
dev_err(&pdev->dev, "failed to enable clock\n");
- goto error_release_master;
+ return ret;
}
mchp_corespi_init(master, spi);
@@ -583,8 +579,6 @@ static int mchp_corespi_probe(struct platform_device *pdev)
error_release_hardware:
mchp_corespi_disable(spi);
clk_disable_unprepare(spi->clk);
-error_release_master:
- spi_master_put(master);
return ret;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master()
2022-07-12 13:53 ` [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master() Yang Yingliang
@ 2022-07-12 14:03 ` Conor.Dooley
2022-07-12 20:50 ` Conor.Dooley
0 siblings, 1 reply; 6+ messages in thread
From: Conor.Dooley @ 2022-07-12 14:03 UTC (permalink / raw)
To: yangyingliang
Cc: Daire.McNamara, broonie, linux-spi, linux-kernel, linux-riscv
On 12/07/2022 14:53, Yang Yingliang wrote:
> [Some people who received this message don't often get email from yangyingliang@huawei.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
>
> Switch to use devm_spi_alloc_master() to simpify error path.
Hey Yang,
Thanks for trying to fix my mistakes!
Forgive my innocence here, but why is it okay to remove the
spi_master_put() in remove() but not the one in the error path of
the probe function?
If the devm_add_action_or_reset() in devm_spi_register_controller()
fails won't the same thing apply to the probe error path?
IOW, I think this patch needs a fixes tag too b/c it also fixes a
refcount underflow. Please correct me if I am misunderstanding.
One other comment below.
>
> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
> ---
> drivers/spi/spi-microchip-core.c | 20 +++++++-------------
> 1 file changed, 7 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c
> index c26767343176..1a24e47f8305 100644
> --- a/drivers/spi/spi-microchip-core.c
> +++ b/drivers/spi/spi-microchip-core.c
> @@ -513,7 +513,7 @@ static int mchp_corespi_probe(struct platform_device *pdev)
> u32 num_cs;
> int ret = 0;
>
> - master = spi_alloc_master(&pdev->dev, sizeof(*spi));
> + master = devm_spi_alloc_master(&pdev->dev, sizeof(*spi));
> if (!master)
> return dev_err_probe(&pdev->dev, -ENOMEM,
> "unable to allocate master for SPI controller\n");
> @@ -535,36 +535,32 @@ static int mchp_corespi_probe(struct platform_device *pdev)
> spi = spi_master_get_devdata(master);
>
> spi->regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
> - if (IS_ERR(spi->regs)) {
> - ret = PTR_ERR(spi->regs);
> - goto error_release_master;
> - }
> + if (IS_ERR(spi->regs))
> + return PTR_ERR(spi->regs);
>
> spi->irq = platform_get_irq(pdev, 0);
> if (spi->irq <= 0) {
> dev_err(&pdev->dev, "invalid IRQ %d for SPI controller\n", spi->irq);
> - ret = -ENXIO;
> - goto error_release_master;
> + return -ENXIO;
Also these can now become dev_err_probe for further simplification?
Thanks,
Conor.
> }
>
> ret = devm_request_irq(&pdev->dev, spi->irq, mchp_corespi_interrupt,
> IRQF_SHARED, dev_name(&pdev->dev), master);
> if (ret) {
> dev_err(&pdev->dev, "could not request irq: %d\n", ret);
> - goto error_release_master;
> + return ret;
> }
>
> spi->clk = devm_clk_get(&pdev->dev, NULL);
> if (IS_ERR(spi->clk)) {
> - ret = PTR_ERR(spi->clk);
> dev_err(&pdev->dev, "could not get clk: %d\n", ret);
> - goto error_release_master;
> + return PTR_ERR(spi->clk);
> }
>
> ret = clk_prepare_enable(spi->clk);
> if (ret) {
> dev_err(&pdev->dev, "failed to enable clock\n");
> - goto error_release_master;
> + return ret;
> }
>
> mchp_corespi_init(master, spi);
> @@ -583,8 +579,6 @@ static int mchp_corespi_probe(struct platform_device *pdev)
> error_release_hardware:
> mchp_corespi_disable(spi);
> clk_disable_unprepare(spi->clk);
> -error_release_master:
> - spi_master_put(master);
>
> return ret;
> }
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master()
2022-07-12 14:03 ` Conor.Dooley
@ 2022-07-12 20:50 ` Conor.Dooley
2022-07-13 2:14 ` Yang Yingliang
0 siblings, 1 reply; 6+ messages in thread
From: Conor.Dooley @ 2022-07-12 20:50 UTC (permalink / raw)
To: yangyingliang
Cc: Daire.McNamara, broonie, linux-spi, linux-kernel, linux-riscv
On 12/07/2022 15:03, Conor.Dooley@microchip.com wrote:
> On 12/07/2022 14:53, Yang Yingliang wrote:
>> [Some people who received this message don't often get email from yangyingliang@huawei.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>>
>> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
>>
>> Switch to use devm_spi_alloc_master() to simpify error path.
>
> Hey Yang,
> Thanks for trying to fix my mistakes!
>
> Forgive my innocence here, but why is it okay to remove the
> spi_master_put() in remove() but not the one in the error path of
> the probe function?
>
> If the devm_add_action_or_reset() in devm_spi_register_controller()
> fails won't the same thing apply to the probe error path?
>
> IOW, I think this patch needs a fixes tag too b/c it also fixes a
> refcount underflow. Please correct me if I am misunderstanding.
Ahh, I just saw your revert of 59ebbe40fb51 ("spi: simplify
devm_spi register_controller"). With that, this makes a lot more
sense.
>
> One other comment below.
This comment still applies for this patch. dev_err_probe would be
nice.
Thanks,
Conor.
>
>>
>> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
>> ---
>> drivers/spi/spi-microchip-core.c | 20 +++++++-------------
>> 1 file changed, 7 insertions(+), 13 deletions(-)
>>
>> diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c
>> index c26767343176..1a24e47f8305 100644
>> --- a/drivers/spi/spi-microchip-core.c
>> +++ b/drivers/spi/spi-microchip-core.c
>> @@ -513,7 +513,7 @@ static int mchp_corespi_probe(struct platform_device *pdev)
>> u32 num_cs;
>> int ret = 0;
>>
>> - master = spi_alloc_master(&pdev->dev, sizeof(*spi));
>> + master = devm_spi_alloc_master(&pdev->dev, sizeof(*spi));
>> if (!master)
>> return dev_err_probe(&pdev->dev, -ENOMEM,
>> "unable to allocate master for SPI controller\n");
>> @@ -535,36 +535,32 @@ static int mchp_corespi_probe(struct platform_device *pdev)
>> spi = spi_master_get_devdata(master);
>>
>> spi->regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
>> - if (IS_ERR(spi->regs)) {
>> - ret = PTR_ERR(spi->regs);
>> - goto error_release_master;
>> - }
>> + if (IS_ERR(spi->regs))
>> + return PTR_ERR(spi->regs);
>>
>> spi->irq = platform_get_irq(pdev, 0);
>> if (spi->irq <= 0) {
>> dev_err(&pdev->dev, "invalid IRQ %d for SPI controller\n", spi->irq);
>> - ret = -ENXIO;
>> - goto error_release_master;
>> + return -ENXIO;
>
> Also these can now become dev_err_probe for further simplification?
> Thanks,
> Conor.
>
>> }
>>
>> ret = devm_request_irq(&pdev->dev, spi->irq, mchp_corespi_interrupt,
>> IRQF_SHARED, dev_name(&pdev->dev), master);
>> if (ret) {
>> dev_err(&pdev->dev, "could not request irq: %d\n", ret);
>> - goto error_release_master;
>> + return ret;
>> }
>>
>> spi->clk = devm_clk_get(&pdev->dev, NULL);
>> if (IS_ERR(spi->clk)) {
>> - ret = PTR_ERR(spi->clk);
>> dev_err(&pdev->dev, "could not get clk: %d\n", ret);
>> - goto error_release_master;
>> + return PTR_ERR(spi->clk);
>> }
>>
>> ret = clk_prepare_enable(spi->clk);
>> if (ret) {
>> dev_err(&pdev->dev, "failed to enable clock\n");
>> - goto error_release_master;
>> + return ret;
>> }
>>
>> mchp_corespi_init(master, spi);
>> @@ -583,8 +579,6 @@ static int mchp_corespi_probe(struct platform_device *pdev)
>> error_release_hardware:
>> mchp_corespi_disable(spi);
>> clk_disable_unprepare(spi->clk);
>> -error_release_master:
>> - spi_master_put(master);
>>
>> return ret;
>> }
>> --
>> 2.25.1
>>
>
> _______________________________________________
> linux-riscv mailing list
> linux-riscv@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove()
2022-07-12 13:53 [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() Yang Yingliang
2022-07-12 13:53 ` [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master() Yang Yingliang
@ 2022-07-12 20:52 ` Conor.Dooley
1 sibling, 0 replies; 6+ messages in thread
From: Conor.Dooley @ 2022-07-12 20:52 UTC (permalink / raw)
To: yangyingliang, broonie
Cc: Conor.Dooley, Daire.McNamara, linux-riscv, linux-kernel, linux-spi
On 12/07/2022 14:53, Yang Yingliang wrote:
> When using devm_spi_register_master(), the unregister function will
> be called in devres_release_all() which is called after ->remove(),
> so remove spi_unregister_master() andspi_master_put().
>
> Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers")
> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
With 59ebbe40fb51 ("spi: simplify devm_spi register_controller") reverted,
this looks good to me.
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Thanks!
> ---
> drivers/spi/spi-microchip-core.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c
> index b3083075cd36..c26767343176 100644
> --- a/drivers/spi/spi-microchip-core.c
> +++ b/drivers/spi/spi-microchip-core.c
> @@ -595,8 +595,6 @@ static int mchp_corespi_remove(struct platform_device *pdev)
> struct mchp_corespi *spi = spi_master_get_devdata(master);
>
> mchp_corespi_disable_ints(spi);
> - spi_unregister_master(master);
> - spi_master_put(master);
> clk_disable_unprepare(spi->clk);
> mchp_corespi_disable(spi);
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master()
2022-07-12 20:50 ` Conor.Dooley
@ 2022-07-13 2:14 ` Yang Yingliang
0 siblings, 0 replies; 6+ messages in thread
From: Yang Yingliang @ 2022-07-13 2:14 UTC (permalink / raw)
To: Conor.Dooley
Cc: Daire.McNamara, broonie, linux-spi, linux-kernel, linux-riscv
On 2022/7/13 4:50, Conor.Dooley@microchip.com wrote:
> On 12/07/2022 15:03, Conor.Dooley@microchip.com wrote:
>> On 12/07/2022 14:53, Yang Yingliang wrote:
>>> [Some people who received this message don't often get email from yangyingliang@huawei.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>>>
>>> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
>>>
>>> Switch to use devm_spi_alloc_master() to simpify error path.
>> Hey Yang,
>> Thanks for trying to fix my mistakes!
>>
>> Forgive my innocence here, but why is it okay to remove the
>> spi_master_put() in remove() but not the one in the error path of
>> the probe function?
>>
>> If the devm_add_action_or_reset() in devm_spi_register_controller()
>> fails won't the same thing apply to the probe error path?
>>
>> IOW, I think this patch needs a fixes tag too b/c it also fixes a
>> refcount underflow. Please correct me if I am misunderstanding.
> Ahh, I just saw your revert of 59ebbe40fb51 ("spi: simplify
> devm_spi register_controller"). With that, this makes a lot more
> sense.
>
>> One other comment below.
> This comment still applies for this patch. dev_err_probe would be
> nice.
OK.
Thanks,
Yang
>
> Thanks,
> Conor.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-07-13 2:14 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-07-12 13:53 [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() Yang Yingliang
2022-07-12 13:53 ` [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master() Yang Yingliang
2022-07-12 14:03 ` Conor.Dooley
2022-07-12 20:50 ` Conor.Dooley
2022-07-13 2:14 ` Yang Yingliang
2022-07-12 20:52 ` [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() Conor.Dooley
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).