Linux-SPI Archive on lore.kernel.org
 help / color / Atom feed
From: Stefan Roese <sr@denx.de>
To: Lukas Wunner <lukas@wunner.de>, Mark Brown <broonie@kernel.org>
Cc: linux-spi@vger.kernel.org, Matthias Brugger <matthias.bgg@gmail.com>
Subject: Re: [PATCH for-5.10] spi: mt7621: Don't leak SPI master in probe error path
Date: Mon, 16 Nov 2020 12:05:25 +0100
Message-ID: <be0493ac-cc02-c79a-afa9-48e959a8442f@denx.de> (raw)
In-Reply-To: <800f7035a29c1ae65386f2e17a2b5ef9d2b39268.1605512876.git.lukas@wunner.de>

On 16.11.20 09:23, Lukas Wunner wrote:
> If the calls to device_reset() or devm_spi_register_controller() fail on
> probe of the MediaTek MT7621 SPI driver, the spi_controller struct is
> erroneously not freed.  Fix by switching over to the new
> devm_spi_alloc_master() helper.
> 
> Moreover, the SYS clock is enabled on probe but not disabled if any of
> the subsequent probe steps fails.
> 
> Finally, there's an ordering issue in mt7621_spi_remove() wherein
> the spi_controller is unregistered after disabling the SYS clock.
> The correct order is to call spi_unregister_controller() *before* this
> teardown step because bus accesses may still be ongoing until that
> function returns.
> 
> All of these bugs have existed since the driver was first introduced,
> so it seems fair to fix them together in a single commit.
> 
> Fixes: 1ab7f2a43558 ("staging: mt7621-spi: add mt7621 support")
> Signed-off-by: Lukas Wunner <lukas@wunner.de>
> Cc: <stable@vger.kernel.org> # v4.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
> Cc: <stable@vger.kernel.org> # v4.17+

Reviewed-by: Stefan Roese <sr@denx.de>

Thanks,
Stefan

> ---
>   drivers/spi/spi-mt7621.c | 18 ++++++++++++++----
>   1 file changed, 14 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/spi/spi-mt7621.c b/drivers/spi/spi-mt7621.c
> index 2c3b7a2a1ec7..d7cda66c4b26 100644
> --- a/drivers/spi/spi-mt7621.c
> +++ b/drivers/spi/spi-mt7621.c
> @@ -350,10 +350,11 @@ static int mt7621_spi_probe(struct platform_device *pdev)
>   	if (status)
>   		return status;
>   
> -	master = spi_alloc_master(&pdev->dev, sizeof(*rs));
> +	master = devm_spi_alloc_master(&pdev->dev, sizeof(*rs));
>   	if (!master) {
>   		dev_info(&pdev->dev, "master allocation failed\n");
> -		return -ENOMEM;
> +		ret = -ENOMEM;
> +		goto err_clk_disable;
>   	}
>   
>   	master->mode_bits = SPI_LSB_FIRST;
> @@ -377,10 +378,18 @@ static int mt7621_spi_probe(struct platform_device *pdev)
>   	ret = device_reset(&pdev->dev);
>   	if (ret) {
>   		dev_err(&pdev->dev, "SPI reset failed!\n");
> -		return ret;
> +		goto err_clk_disable;
>   	}
>   
> -	return devm_spi_register_controller(&pdev->dev, master);
> +	ret = spi_register_controller(master);
> +	if (ret)
> +		goto err_clk_disable;
> +
> +	return 0;
> +
> +err_clk_disable:
> +	clk_disable_unprepare(clk);
> +	return ret;
>   }
>   
>   static int mt7621_spi_remove(struct platform_device *pdev)
> @@ -391,6 +400,7 @@ static int mt7621_spi_remove(struct platform_device *pdev)
>   	master = dev_get_drvdata(&pdev->dev);
>   	rs = spi_controller_get_devdata(master);
>   
> +	spi_unregister_controller(master);
>   	clk_disable_unprepare(rs->clk);
>   
>   	return 0;
> 

  reply index

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-11-16  8:23 [PATCH for-5.10] spi: spi-geni-qcom: Fix use-after-free on unbind Lukas Wunner
2020-11-16  8:23 ` [PATCH for-5.10] spi: spi-qcom-qspi: " Lukas Wunner
2020-11-16  8:23 ` [PATCH for-5.10] spi: spi-sh: " Lukas Wunner
2020-11-16  8:23 ` [PATCH for-5.10] spi: pxa2xx: " Lukas Wunner
2020-11-16  8:23 ` [PATCH for-5.10] spi: rpc-if: " Lukas Wunner
2020-11-28 20:20   ` Sergey Shtylyov
2020-11-29 11:35     ` Lukas Wunner
2020-11-30 19:18       ` Sergey Shtylyov
2020-12-02 11:43         ` Lukas Wunner
2020-11-16  8:23 ` [PATCH for-5.10] spi: mxic: Don't leak SPI master in probe error path Lukas Wunner
2020-11-16  8:23 ` [PATCH for-5.10] spi: mt7621: " Lukas Wunner
2020-11-16 11:05   ` Stefan Roese [this message]
2020-11-16  8:23 ` [PATCH for-5.10] spi: spi-mtk-nor: " Lukas Wunner
2020-11-17  4:02   ` Ikjoon Jang
2020-11-17 12:32   ` Mark Brown
2020-11-16  8:23 ` [PATCH for-5.10] spi: gpio: " Lukas Wunner
2020-11-16 19:23   ` Andrey Smirnov
2020-11-16 23:03     ` Lukas Wunner
2020-11-16 23:59       ` Andrey Smirnov
2020-11-18  1:08   ` Linus Walleij
2020-11-16  8:23 ` [PATCH for-5.10] spi: npcm-fiu: " Lukas Wunner
2020-11-17 22:38   ` Mark Brown
2020-12-01 13:57   ` Mark Brown
2020-12-01 14:30     ` Lukas Wunner
2020-12-01 17:17       ` Mark Brown
2020-12-01 17:49         ` Lukas Wunner
2020-12-02 15:17           ` Mark Brown
2020-11-16  8:23 ` [PATCH for-5.10] spi: rb4xx: " Lukas Wunner
2020-11-16  8:23 ` [PATCH for-5.10] spi: sc18is602: " Lukas Wunner
2020-11-16  8:23 ` [PATCH for-5.10] media: netup_unidvb: " Lukas Wunner
2020-11-23 14:06   ` Mauro Carvalho Chehab
2020-12-01 13:57   ` Mark Brown

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=be0493ac-cc02-c79a-afa9-48e959a8442f@denx.de \
    --to=sr@denx.de \
    --cc=broonie@kernel.org \
    --cc=linux-spi@vger.kernel.org \
    --cc=lukas@wunner.de \
    --cc=matthias.bgg@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-SPI Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-spi/0 linux-spi/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-spi linux-spi/ https://lore.kernel.org/linux-spi \
		linux-spi@vger.kernel.org
	public-inbox-index linux-spi

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-spi


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git