From: Yang Yingliang Date: Tue, 12 Jul 2022 13:55:04 +0000 (+0800) Subject: spi: Fix simplification of devm_spi_register_controller X-Git-Tag: v5.15.73~1596 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=445fb9c19cf45bd9472fd9babaa31c5e6c7d2720;p=platform%2Fkernel%2Flinux-rpi.git spi: Fix simplification of devm_spi_register_controller [ Upstream commit 43cc5a0afe4184a7fafe1eba32b5a11bb69c9ce0 ] This reverts commit 59ebbe40fb51 ("spi: simplify devm_spi_register_controller"). If devm_add_action() fails in devm_add_action_or_reset(), devm_spi_unregister() will be called, it decreases the refcount of 'ctlr->dev' to 0, then it will cause uaf in the drivers that calling spi_put_controller() in error path. Fixes: 59ebbe40fb51 ("spi: simplify devm_spi_register_controller") Signed-off-by: Yang Yingliang Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20220712135504.1055688-1-yangyingliang@huawei.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin --- diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index d0bbf8f..556d65a 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -2949,9 +2949,9 @@ free_bus_id: } EXPORT_SYMBOL_GPL(spi_register_controller); -static void devm_spi_unregister(void *ctlr) +static void devm_spi_unregister(struct device *dev, void *res) { - spi_unregister_controller(ctlr); + spi_unregister_controller(*(struct spi_controller **)res); } /** @@ -2970,13 +2970,22 @@ static void devm_spi_unregister(void *ctlr) int devm_spi_register_controller(struct device *dev, struct spi_controller *ctlr) { + struct spi_controller **ptr; int ret; + ptr = devres_alloc(devm_spi_unregister, sizeof(*ptr), GFP_KERNEL); + if (!ptr) + return -ENOMEM; + ret = spi_register_controller(ctlr); - if (ret) - return ret; + if (!ret) { + *ptr = ctlr; + devres_add(dev, ptr); + } else { + devres_free(ptr); + } - return devm_add_action_or_reset(dev, devm_spi_unregister, ctlr); + return ret; } EXPORT_SYMBOL_GPL(devm_spi_register_controller);