* [PATCH 4.19 4.14 4.9 4.4-stable 1/2] spi: bcm2835aux: Fix use-after-free on unbind
@ 2020-12-10 19:20 Lukas Wunner
2020-12-10 19:20 ` [PATCH 4.19 4.14 4.9 4.4-stable 2/2] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe Lukas Wunner
2020-12-11 14:43 ` [PATCH 4.19 4.14 4.9 4.4-stable 1/2] spi: bcm2835aux: Fix use-after-free on unbind Greg KH
0 siblings, 2 replies; 3+ messages in thread
From: Lukas Wunner @ 2020-12-10 19:20 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Mark Brown, Sudip Mukherjee, Sasha Levin, Nathan Chancellor, stable
[ Upstream commit e13ee6cc4781edaf8c7321bee19217e3702ed481 ]
bcm2835aux_spi_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.
Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.
Fixes: b9dd3f6d4172 ("spi: bcm2835aux: Fix controller unregister order")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.4+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order
Cc: <stable@vger.kernel.org> # v4.4+
Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
---
drivers/spi/spi-bcm2835aux.c | 18 ++++++------------
1 file changed, 6 insertions(+), 12 deletions(-)
diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 11895c98aae3..41980ee115da 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -407,7 +407,7 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
unsigned long clk_hz;
int err;
- master = spi_alloc_master(&pdev->dev, sizeof(*bs));
+ master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
if (!master) {
dev_err(&pdev->dev, "spi_alloc_master() failed\n");
return -ENOMEM;
@@ -439,30 +439,26 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
/* the main area */
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
bs->regs = devm_ioremap_resource(&pdev->dev, res);
- if (IS_ERR(bs->regs)) {
- err = PTR_ERR(bs->regs);
- goto out_master_put;
- }
+ if (IS_ERR(bs->regs))
+ return PTR_ERR(bs->regs);
bs->clk = devm_clk_get(&pdev->dev, NULL);
if ((!bs->clk) || (IS_ERR(bs->clk))) {
- err = PTR_ERR(bs->clk);
dev_err(&pdev->dev, "could not get clk: %d\n", err);
- goto out_master_put;
+ return PTR_ERR(bs->clk);
}
bs->irq = platform_get_irq(pdev, 0);
if (bs->irq <= 0) {
dev_err(&pdev->dev, "could not get IRQ: %d\n", bs->irq);
- err = bs->irq ? bs->irq : -ENODEV;
- goto out_master_put;
+ return bs->irq ? bs->irq : -ENODEV;
}
/* this also enables the HW block */
err = clk_prepare_enable(bs->clk);
if (err) {
dev_err(&pdev->dev, "could not prepare clock: %d\n", err);
- goto out_master_put;
+ return err;
}
/* just checking if the clock returns a sane value */
@@ -495,8 +491,6 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
out_clk_disable:
clk_disable_unprepare(bs->clk);
-out_master_put:
- spi_master_put(master);
return err;
}
--
2.29.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 4.19 4.14 4.9 4.4-stable 2/2] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe
2020-12-10 19:20 [PATCH 4.19 4.14 4.9 4.4-stable 1/2] spi: bcm2835aux: Fix use-after-free on unbind Lukas Wunner
@ 2020-12-10 19:20 ` Lukas Wunner
2020-12-11 14:43 ` [PATCH 4.19 4.14 4.9 4.4-stable 1/2] spi: bcm2835aux: Fix use-after-free on unbind Greg KH
1 sibling, 0 replies; 3+ messages in thread
From: Lukas Wunner @ 2020-12-10 19:20 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Mark Brown, Sudip Mukherjee, Sasha Levin, Nathan Chancellor, stable
From: Nathan Chancellor <natechancellor@gmail.com>
[ Upstream commit d853b3406903a7dc5b14eb5bada3e8cd677f66a2 ]
Clang warns:
drivers/spi/spi-bcm2835aux.c:532:50: warning: variable 'err' is
uninitialized when used here [-Wuninitialized]
dev_err(&pdev->dev, "could not get clk: %d\n", err);
^~~
./include/linux/dev_printk.h:112:32: note: expanded from macro 'dev_err'
_dev_err(dev, dev_fmt(fmt), ##__VA_ARGS__)
^~~~~~~~~~~
drivers/spi/spi-bcm2835aux.c:495:9: note: initialize the variable 'err'
to silence this warning
int err;
^
= 0
1 warning generated.
Restore the assignment so that the error value can be used in the
dev_err statement and there is no uninitialized memory being leaked.
Fixes: e13ee6cc4781 ("spi: bcm2835aux: Fix use-after-free on unbind")
Link: https://github.com/ClangBuiltLinux/linux/issues/1199
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Link: https://lore.kernel.org/r/20201113180701.455541-1-natechancellor@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
[lukas: backport to 4.19-stable, add stable designation]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.4+: e13ee6cc4781: spi: bcm2835aux: Fix use-after-free on unbind
Cc: <stable@vger.kernel.org> # v4.4+
---
drivers/spi/spi-bcm2835aux.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 41980ee115da..8ea7e31b8c2f 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -444,8 +444,9 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
bs->clk = devm_clk_get(&pdev->dev, NULL);
if ((!bs->clk) || (IS_ERR(bs->clk))) {
+ err = PTR_ERR(bs->clk);
dev_err(&pdev->dev, "could not get clk: %d\n", err);
- return PTR_ERR(bs->clk);
+ return err;
}
bs->irq = platform_get_irq(pdev, 0);
--
2.29.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 4.19 4.14 4.9 4.4-stable 1/2] spi: bcm2835aux: Fix use-after-free on unbind
2020-12-10 19:20 [PATCH 4.19 4.14 4.9 4.4-stable 1/2] spi: bcm2835aux: Fix use-after-free on unbind Lukas Wunner
2020-12-10 19:20 ` [PATCH 4.19 4.14 4.9 4.4-stable 2/2] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe Lukas Wunner
@ 2020-12-11 14:43 ` Greg KH
1 sibling, 0 replies; 3+ messages in thread
From: Greg KH @ 2020-12-11 14:43 UTC (permalink / raw)
To: Lukas Wunner
Cc: Greg Kroah-Hartman, Mark Brown, Sudip Mukherjee, Sasha Levin,
Nathan Chancellor, stable
On Thu, Dec 10, 2020 at 08:20:01PM +0100, Lukas Wunner wrote:
> [ Upstream commit e13ee6cc4781edaf8c7321bee19217e3702ed481 ]
>
Both patches now queued up everywhere, thanks!
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-12-11 15:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-10 19:20 [PATCH 4.19 4.14 4.9 4.4-stable 1/2] spi: bcm2835aux: Fix use-after-free on unbind Lukas Wunner
2020-12-10 19:20 ` [PATCH 4.19 4.14 4.9 4.4-stable 2/2] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe Lukas Wunner
2020-12-11 14:43 ` [PATCH 4.19 4.14 4.9 4.4-stable 1/2] spi: bcm2835aux: Fix use-after-free on unbind Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).