* [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove()
@ 2022-07-12 13:53 Yang Yingliang
2022-07-12 13:53 ` [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master() Yang Yingliang
2022-07-12 20:52 ` [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() Conor.Dooley
0 siblings, 2 replies; 6+ messages in thread
From: Yang Yingliang @ 2022-07-12 13:53 UTC (permalink / raw)
To: linux-kernel, linux-spi, linux-riscv
Cc: conor.dooley, daire.mcnamara, broonie
When using devm_spi_register_master(), the unregister function will
be called in devres_release_all() which is called after ->remove(),
so remove spi_unregister_master() andspi_master_put().
Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
drivers/spi/spi-microchip-core.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c
index b3083075cd36..c26767343176 100644
--- a/drivers/spi/spi-microchip-core.c
+++ b/drivers/spi/spi-microchip-core.c
@@ -595,8 +595,6 @@ static int mchp_corespi_remove(struct platform_device *pdev)
struct mchp_corespi *spi = spi_master_get_devdata(master);
mchp_corespi_disable_ints(spi);
- spi_unregister_master(master);
- spi_master_put(master);
clk_disable_unprepare(spi->clk);
mchp_corespi_disable(spi);
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master() 2022-07-12 13:53 [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() Yang Yingliang @ 2022-07-12 13:53 ` Yang Yingliang 2022-07-12 14:03 ` Conor.Dooley 2022-07-12 20:52 ` [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() Conor.Dooley 1 sibling, 1 reply; 6+ messages in thread From: Yang Yingliang @ 2022-07-12 13:53 UTC (permalink / raw) To: linux-kernel, linux-spi, linux-riscv Cc: conor.dooley, daire.mcnamara, broonie Switch to use devm_spi_alloc_master() to simpify error path. Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- drivers/spi/spi-microchip-core.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c index c26767343176..1a24e47f8305 100644 --- a/drivers/spi/spi-microchip-core.c +++ b/drivers/spi/spi-microchip-core.c @@ -513,7 +513,7 @@ static int mchp_corespi_probe(struct platform_device *pdev) u32 num_cs; int ret = 0; - master = spi_alloc_master(&pdev->dev, sizeof(*spi)); + master = devm_spi_alloc_master(&pdev->dev, sizeof(*spi)); if (!master) return dev_err_probe(&pdev->dev, -ENOMEM, "unable to allocate master for SPI controller\n"); @@ -535,36 +535,32 @@ static int mchp_corespi_probe(struct platform_device *pdev) spi = spi_master_get_devdata(master); spi->regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res); - if (IS_ERR(spi->regs)) { - ret = PTR_ERR(spi->regs); - goto error_release_master; - } + if (IS_ERR(spi->regs)) + return PTR_ERR(spi->regs); spi->irq = platform_get_irq(pdev, 0); if (spi->irq <= 0) { dev_err(&pdev->dev, "invalid IRQ %d for SPI controller\n", spi->irq); - ret = -ENXIO; - goto error_release_master; + return -ENXIO; } ret = devm_request_irq(&pdev->dev, spi->irq, mchp_corespi_interrupt, IRQF_SHARED, dev_name(&pdev->dev), master); if (ret) { dev_err(&pdev->dev, "could not request irq: %d\n", ret); - goto error_release_master; + return ret; } spi->clk = devm_clk_get(&pdev->dev, NULL); if (IS_ERR(spi->clk)) { - ret = PTR_ERR(spi->clk); dev_err(&pdev->dev, "could not get clk: %d\n", ret); - goto error_release_master; + return PTR_ERR(spi->clk); } ret = clk_prepare_enable(spi->clk); if (ret) { dev_err(&pdev->dev, "failed to enable clock\n"); - goto error_release_master; + return ret; } mchp_corespi_init(master, spi); @@ -583,8 +579,6 @@ static int mchp_corespi_probe(struct platform_device *pdev) error_release_hardware: mchp_corespi_disable(spi); clk_disable_unprepare(spi->clk); -error_release_master: - spi_master_put(master); return ret; } -- 2.25.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master() 2022-07-12 13:53 ` [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master() Yang Yingliang @ 2022-07-12 14:03 ` Conor.Dooley 2022-07-12 20:50 ` Conor.Dooley 0 siblings, 1 reply; 6+ messages in thread From: Conor.Dooley @ 2022-07-12 14:03 UTC (permalink / raw) To: yangyingliang Cc: Daire.McNamara, broonie, linux-spi, linux-kernel, linux-riscv On 12/07/2022 14:53, Yang Yingliang wrote: > [Some people who received this message don't often get email from yangyingliang@huawei.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] > > EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe > > Switch to use devm_spi_alloc_master() to simpify error path. Hey Yang, Thanks for trying to fix my mistakes! Forgive my innocence here, but why is it okay to remove the spi_master_put() in remove() but not the one in the error path of the probe function? If the devm_add_action_or_reset() in devm_spi_register_controller() fails won't the same thing apply to the probe error path? IOW, I think this patch needs a fixes tag too b/c it also fixes a refcount underflow. Please correct me if I am misunderstanding. One other comment below. > > Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> > --- > drivers/spi/spi-microchip-core.c | 20 +++++++------------- > 1 file changed, 7 insertions(+), 13 deletions(-) > > diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c > index c26767343176..1a24e47f8305 100644 > --- a/drivers/spi/spi-microchip-core.c > +++ b/drivers/spi/spi-microchip-core.c > @@ -513,7 +513,7 @@ static int mchp_corespi_probe(struct platform_device *pdev) > u32 num_cs; > int ret = 0; > > - master = spi_alloc_master(&pdev->dev, sizeof(*spi)); > + master = devm_spi_alloc_master(&pdev->dev, sizeof(*spi)); > if (!master) > return dev_err_probe(&pdev->dev, -ENOMEM, > "unable to allocate master for SPI controller\n"); > @@ -535,36 +535,32 @@ static int mchp_corespi_probe(struct platform_device *pdev) > spi = spi_master_get_devdata(master); > > spi->regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res); > - if (IS_ERR(spi->regs)) { > - ret = PTR_ERR(spi->regs); > - goto error_release_master; > - } > + if (IS_ERR(spi->regs)) > + return PTR_ERR(spi->regs); > > spi->irq = platform_get_irq(pdev, 0); > if (spi->irq <= 0) { > dev_err(&pdev->dev, "invalid IRQ %d for SPI controller\n", spi->irq); > - ret = -ENXIO; > - goto error_release_master; > + return -ENXIO; Also these can now become dev_err_probe for further simplification? Thanks, Conor. > } > > ret = devm_request_irq(&pdev->dev, spi->irq, mchp_corespi_interrupt, > IRQF_SHARED, dev_name(&pdev->dev), master); > if (ret) { > dev_err(&pdev->dev, "could not request irq: %d\n", ret); > - goto error_release_master; > + return ret; > } > > spi->clk = devm_clk_get(&pdev->dev, NULL); > if (IS_ERR(spi->clk)) { > - ret = PTR_ERR(spi->clk); > dev_err(&pdev->dev, "could not get clk: %d\n", ret); > - goto error_release_master; > + return PTR_ERR(spi->clk); > } > > ret = clk_prepare_enable(spi->clk); > if (ret) { > dev_err(&pdev->dev, "failed to enable clock\n"); > - goto error_release_master; > + return ret; > } > > mchp_corespi_init(master, spi); > @@ -583,8 +579,6 @@ static int mchp_corespi_probe(struct platform_device *pdev) > error_release_hardware: > mchp_corespi_disable(spi); > clk_disable_unprepare(spi->clk); > -error_release_master: > - spi_master_put(master); > > return ret; > } > -- > 2.25.1 > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master() 2022-07-12 14:03 ` Conor.Dooley @ 2022-07-12 20:50 ` Conor.Dooley 2022-07-13 2:14 ` Yang Yingliang 0 siblings, 1 reply; 6+ messages in thread From: Conor.Dooley @ 2022-07-12 20:50 UTC (permalink / raw) To: yangyingliang Cc: Daire.McNamara, broonie, linux-spi, linux-kernel, linux-riscv On 12/07/2022 15:03, Conor.Dooley@microchip.com wrote: > On 12/07/2022 14:53, Yang Yingliang wrote: >> [Some people who received this message don't often get email from yangyingliang@huawei.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] >> >> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe >> >> Switch to use devm_spi_alloc_master() to simpify error path. > > Hey Yang, > Thanks for trying to fix my mistakes! > > Forgive my innocence here, but why is it okay to remove the > spi_master_put() in remove() but not the one in the error path of > the probe function? > > If the devm_add_action_or_reset() in devm_spi_register_controller() > fails won't the same thing apply to the probe error path? > > IOW, I think this patch needs a fixes tag too b/c it also fixes a > refcount underflow. Please correct me if I am misunderstanding. Ahh, I just saw your revert of 59ebbe40fb51 ("spi: simplify devm_spi register_controller"). With that, this makes a lot more sense. > > One other comment below. This comment still applies for this patch. dev_err_probe would be nice. Thanks, Conor. > >> >> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> >> --- >> drivers/spi/spi-microchip-core.c | 20 +++++++------------- >> 1 file changed, 7 insertions(+), 13 deletions(-) >> >> diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c >> index c26767343176..1a24e47f8305 100644 >> --- a/drivers/spi/spi-microchip-core.c >> +++ b/drivers/spi/spi-microchip-core.c >> @@ -513,7 +513,7 @@ static int mchp_corespi_probe(struct platform_device *pdev) >> u32 num_cs; >> int ret = 0; >> >> - master = spi_alloc_master(&pdev->dev, sizeof(*spi)); >> + master = devm_spi_alloc_master(&pdev->dev, sizeof(*spi)); >> if (!master) >> return dev_err_probe(&pdev->dev, -ENOMEM, >> "unable to allocate master for SPI controller\n"); >> @@ -535,36 +535,32 @@ static int mchp_corespi_probe(struct platform_device *pdev) >> spi = spi_master_get_devdata(master); >> >> spi->regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res); >> - if (IS_ERR(spi->regs)) { >> - ret = PTR_ERR(spi->regs); >> - goto error_release_master; >> - } >> + if (IS_ERR(spi->regs)) >> + return PTR_ERR(spi->regs); >> >> spi->irq = platform_get_irq(pdev, 0); >> if (spi->irq <= 0) { >> dev_err(&pdev->dev, "invalid IRQ %d for SPI controller\n", spi->irq); >> - ret = -ENXIO; >> - goto error_release_master; >> + return -ENXIO; > > Also these can now become dev_err_probe for further simplification? > Thanks, > Conor. > >> } >> >> ret = devm_request_irq(&pdev->dev, spi->irq, mchp_corespi_interrupt, >> IRQF_SHARED, dev_name(&pdev->dev), master); >> if (ret) { >> dev_err(&pdev->dev, "could not request irq: %d\n", ret); >> - goto error_release_master; >> + return ret; >> } >> >> spi->clk = devm_clk_get(&pdev->dev, NULL); >> if (IS_ERR(spi->clk)) { >> - ret = PTR_ERR(spi->clk); >> dev_err(&pdev->dev, "could not get clk: %d\n", ret); >> - goto error_release_master; >> + return PTR_ERR(spi->clk); >> } >> >> ret = clk_prepare_enable(spi->clk); >> if (ret) { >> dev_err(&pdev->dev, "failed to enable clock\n"); >> - goto error_release_master; >> + return ret; >> } >> >> mchp_corespi_init(master, spi); >> @@ -583,8 +579,6 @@ static int mchp_corespi_probe(struct platform_device *pdev) >> error_release_hardware: >> mchp_corespi_disable(spi); >> clk_disable_unprepare(spi->clk); >> -error_release_master: >> - spi_master_put(master); >> >> return ret; >> } >> -- >> 2.25.1 >> > > _______________________________________________ > linux-riscv mailing list > linux-riscv@lists.infradead.org > http://lists.infradead.org/mailman/listinfo/linux-riscv ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master() 2022-07-12 20:50 ` Conor.Dooley @ 2022-07-13 2:14 ` Yang Yingliang 0 siblings, 0 replies; 6+ messages in thread From: Yang Yingliang @ 2022-07-13 2:14 UTC (permalink / raw) To: Conor.Dooley Cc: Daire.McNamara, broonie, linux-spi, linux-kernel, linux-riscv On 2022/7/13 4:50, Conor.Dooley@microchip.com wrote: > On 12/07/2022 15:03, Conor.Dooley@microchip.com wrote: >> On 12/07/2022 14:53, Yang Yingliang wrote: >>> [Some people who received this message don't often get email from yangyingliang@huawei.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] >>> >>> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe >>> >>> Switch to use devm_spi_alloc_master() to simpify error path. >> Hey Yang, >> Thanks for trying to fix my mistakes! >> >> Forgive my innocence here, but why is it okay to remove the >> spi_master_put() in remove() but not the one in the error path of >> the probe function? >> >> If the devm_add_action_or_reset() in devm_spi_register_controller() >> fails won't the same thing apply to the probe error path? >> >> IOW, I think this patch needs a fixes tag too b/c it also fixes a >> refcount underflow. Please correct me if I am misunderstanding. > Ahh, I just saw your revert of 59ebbe40fb51 ("spi: simplify > devm_spi register_controller"). With that, this makes a lot more > sense. > >> One other comment below. > This comment still applies for this patch. dev_err_probe would be > nice. OK. Thanks, Yang > > Thanks, > Conor. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() 2022-07-12 13:53 [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() Yang Yingliang 2022-07-12 13:53 ` [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master() Yang Yingliang @ 2022-07-12 20:52 ` Conor.Dooley 1 sibling, 0 replies; 6+ messages in thread From: Conor.Dooley @ 2022-07-12 20:52 UTC (permalink / raw) To: yangyingliang, broonie Cc: Conor.Dooley, Daire.McNamara, linux-riscv, linux-kernel, linux-spi On 12/07/2022 14:53, Yang Yingliang wrote: > When using devm_spi_register_master(), the unregister function will > be called in devres_release_all() which is called after ->remove(), > so remove spi_unregister_master() andspi_master_put(). > > Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers") > Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> With 59ebbe40fb51 ("spi: simplify devm_spi register_controller") reverted, this looks good to me. Reviewed-by: Conor Dooley <conor.dooley@microchip.com> Thanks! > --- > drivers/spi/spi-microchip-core.c | 2 -- > 1 file changed, 2 deletions(-) > > diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c > index b3083075cd36..c26767343176 100644 > --- a/drivers/spi/spi-microchip-core.c > +++ b/drivers/spi/spi-microchip-core.c > @@ -595,8 +595,6 @@ static int mchp_corespi_remove(struct platform_device *pdev) > struct mchp_corespi *spi = spi_master_get_devdata(master); > > mchp_corespi_disable_ints(spi); > - spi_unregister_master(master); > - spi_master_put(master); > clk_disable_unprepare(spi->clk); > mchp_corespi_disable(spi); > ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-07-13 2:14 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2022-07-12 13:53 [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() Yang Yingliang 2022-07-12 13:53 ` [PATCH -next 2/2] spi: microchip-core: switch to use devm_spi_alloc_master() Yang Yingliang 2022-07-12 14:03 ` Conor.Dooley 2022-07-12 20:50 ` Conor.Dooley 2022-07-13 2:14 ` Yang Yingliang 2022-07-12 20:52 ` [PATCH -next 1/2] spi: microchip-core: fix UAF in mchp_corespi_remove() Conor.Dooley
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).