Re: [PATCH 17/17] spi: atmel-quadspi: Fix use-after-free on unbind

[<Tudor.Ambarus@microchip.com>]

On 12/7/20 10:17 AM, Lukas Wunner wrote:
> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
> 
> atmel_qspi_remove() accesses the driver's private data after calling
> spi_unregister_controller() even though that function releases the last
> reference on the spi_controller and thereby frees the private data.
> 
> Fix by switching over to the new devm_spi_alloc_master() helper which
> keeps the private data accessible until the driver has unbound.
> 
> Fixes: 2d30ac5ed633 ("mtd: spi-nor: atmel-quadspi: Use spi-mem interface for atmel-quadspi driver")
> Signed-off-by: Lukas Wunner <lukas@wunner.de>
> Cc: <stable@vger.kernel.org> # v5.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
> Cc: <stable@vger.kernel.org> # v5.0+
> Cc: Piotr Bugalski <bugalski.piotr@gmail.com>

Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>

> ---
>  drivers/spi/atmel-quadspi.c | 15 +++++----------
>  1 file changed, 5 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c
> index b44521d4a245..1742ccc1ad0e 100644
> --- a/drivers/spi/atmel-quadspi.c
> +++ b/drivers/spi/atmel-quadspi.c
> @@ -535,7 +535,7 @@ static int atmel_qspi_probe(struct platform_device *pdev)
>         struct resource *res;
>         int irq, err = 0;
> 
> -       ctrl = spi_alloc_master(&pdev->dev, sizeof(*aq));
> +       ctrl = devm_spi_alloc_master(&pdev->dev, sizeof(*aq));
>         if (!ctrl)
>                 return -ENOMEM;
> 
> @@ -557,8 +557,7 @@ static int atmel_qspi_probe(struct platform_device *pdev)
>         aq->regs = devm_ioremap_resource(&pdev->dev, res);
>         if (IS_ERR(aq->regs)) {
>                 dev_err(&pdev->dev, "missing registers\n");
> -               err = PTR_ERR(aq->regs);
> -               goto exit;
> +               return PTR_ERR(aq->regs);
>         }
> 
>         /* Map the AHB memory */
> @@ -566,8 +565,7 @@ static int atmel_qspi_probe(struct platform_device *pdev)
>         aq->mem = devm_ioremap_resource(&pdev->dev, res);
>         if (IS_ERR(aq->mem)) {
>                 dev_err(&pdev->dev, "missing AHB memory\n");
> -               err = PTR_ERR(aq->mem);
> -               goto exit;
> +               return PTR_ERR(aq->mem);
>         }
> 
>         aq->mmap_size = resource_size(res);
> @@ -579,15 +577,14 @@ static int atmel_qspi_probe(struct platform_device *pdev)
> 
>         if (IS_ERR(aq->pclk)) {
>                 dev_err(&pdev->dev, "missing peripheral clock\n");
> -               err = PTR_ERR(aq->pclk);
> -               goto exit;
> +               return PTR_ERR(aq->pclk);
>         }
> 
>         /* Enable the peripheral clock */
>         err = clk_prepare_enable(aq->pclk);
>         if (err) {
>                 dev_err(&pdev->dev, "failed to enable the peripheral clock\n");
> -               goto exit;
> +               return err;
>         }
> 
>         aq->caps = of_device_get_match_data(&pdev->dev);
> @@ -638,8 +635,6 @@ static int atmel_qspi_probe(struct platform_device *pdev)
>         clk_disable_unprepare(aq->qspick);
>  disable_pclk:
>         clk_disable_unprepare(aq->pclk);
> -exit:
> -       spi_controller_put(ctrl);
> 
>         return err;
>  }
> --
> 2.29.2
>