[PATCH] EDAC/mpc85xx: manage controller info lifetime via devres

[Rosen Penev <rosenp@gmail.com>]

mpc85xx_pci_err_probe() and mpc85xx_l2_err_probe() request their shared
interrupt with devm_request_irq(), passing the allocated control info
(pci / edac_dev) as the handler context. At removal the driver frees
that control info explicitly via edac_pci_free_ctl_info() /
edac_device_free_ctl_info() before devres tears down the IRQ, leaving a
use-after-free window in which a peer device on the shared line can fire
and the ISR dereferences the freed structure.

Register a free callback via devm_add_action_or_reset() immediately after
allocation so the control info is owned by devres and freed only after
the devm IRQ is released (devres runs actions in LIFO order). Drop the
explicit frees from both the probe error paths and the remove callbacks,
and remove the now-redundant devres group open/release/remove calls.

Built for powerpc (CONFIG_EDAC_MPC85XX) with LLVM=1;
drivers/edac/mpc85xx_edac.o compiles cleanly and passes checkpatch
--strict.

Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/edac/mpc85xx_edac.c | 42 +++++++++++++++++++++----------------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c
index 7bb13f85ce57..13c88600f7b5 100644
--- a/drivers/edac/mpc85xx_edac.c
+++ b/drivers/edac/mpc85xx_edac.c
@@ -141,6 +141,13 @@ static irqreturn_t mpc85xx_pci_isr(int irq, void *dev_id)
 	return IRQ_HANDLED;
 }
 
+static void mpc85xx_pci_edac_free(void *data)
+{
+	struct edac_pci_ctl_info *pci = data;
+
+	edac_pci_free_ctl_info(pci);
+}
+
 static int mpc85xx_pci_err_probe(struct platform_device *op)
 {
 	struct edac_pci_ctl_info *pci;
@@ -150,13 +157,14 @@ static int mpc85xx_pci_err_probe(struct platform_device *op)
 	struct resource r;
 	int res = 0;
 
-	if (!devres_open_group(&op->dev, mpc85xx_pci_err_probe, GFP_KERNEL))
-		return -ENOMEM;
-
 	pci = edac_pci_alloc_ctl_info(sizeof(*pdata), "mpc85xx_pci_err");
 	if (!pci)
 		return -ENOMEM;
 
+	res = devm_add_action_or_reset(&op->dev, mpc85xx_pci_edac_free, pci);
+	if (res)
+		return res;
+
 	/* make sure error reporting method is sane */
 	switch (edac_op_state) {
 	case EDAC_OPSTATE_POLL:
@@ -285,7 +293,6 @@ static int mpc85xx_pci_err_probe(struct platform_device *op)
 			 | PEX_ERR_ICCAD_DISR_BIT);
 	}
 
-	devres_remove_group(&op->dev, mpc85xx_pci_err_probe);
 	edac_dbg(3, "success\n");
 	pr_info(EDAC_MOD_STR " PCI err registered\n");
 
@@ -294,8 +301,6 @@ static int mpc85xx_pci_err_probe(struct platform_device *op)
 err2:
 	edac_pci_del_device(&op->dev);
 err:
-	edac_pci_free_ctl_info(pci);
-	devres_release_group(&op->dev, mpc85xx_pci_err_probe);
 	return res;
 }
 
@@ -310,7 +315,6 @@ static void mpc85xx_pci_err_remove(struct platform_device *op)
 	out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_EN, orig_pci_err_en);
 
 	edac_pci_del_device(&op->dev);
-	edac_pci_free_ctl_info(pci);
 }
 
 static const struct platform_device_id mpc85xx_pci_err_match[] = {
@@ -484,6 +488,13 @@ static irqreturn_t mpc85xx_l2_isr(int irq, void *dev_id)
 	return IRQ_HANDLED;
 }
 
+static void mpc85xx_l2_edac_free(void *data)
+{
+	struct edac_device_ctl_info *edac_dev = data;
+
+	edac_device_free_ctl_info(edac_dev);
+}
+
 static int mpc85xx_l2_err_probe(struct platform_device *op)
 {
 	struct edac_device_ctl_info *edac_dev;
@@ -491,16 +502,16 @@ static int mpc85xx_l2_err_probe(struct platform_device *op)
 	struct resource r;
 	int res;
 
-	if (!devres_open_group(&op->dev, mpc85xx_l2_err_probe, GFP_KERNEL))
-		return -ENOMEM;
-
 	edac_dev = edac_device_alloc_ctl_info(sizeof(*pdata),
 					      "cpu", 1, "L", 1, 2,
 					      edac_dev_idx);
-	if (!edac_dev) {
-		devres_release_group(&op->dev, mpc85xx_l2_err_probe);
+	if (!edac_dev)
 		return -ENOMEM;
-	}
+
+	res = devm_add_action_or_reset(&op->dev, mpc85xx_l2_edac_free,
+				       edac_dev);
+	if (res)
+		return res;
 
 	pdata = edac_dev->pvt_info;
 	pdata->name = "mpc85xx_l2_err";
@@ -573,8 +584,6 @@ static int mpc85xx_l2_err_probe(struct platform_device *op)
 		out_be32(pdata->l2_vbase + MPC85XX_L2_ERRINTEN, L2_EIE_MASK);
 	}
 
-	devres_remove_group(&op->dev, mpc85xx_l2_err_probe);
-
 	edac_dbg(3, "success\n");
 	pr_info(EDAC_MOD_STR " L2 err registered\n");
 
@@ -583,8 +592,6 @@ static int mpc85xx_l2_err_probe(struct platform_device *op)
 err2:
 	edac_device_del_device(&op->dev);
 err:
-	devres_release_group(&op->dev, mpc85xx_l2_err_probe);
-	edac_device_free_ctl_info(edac_dev);
 	return res;
 }
 
@@ -602,7 +609,6 @@ static void mpc85xx_l2_err_remove(struct platform_device *op)
 
 	out_be32(pdata->l2_vbase + MPC85XX_L2_ERRDIS, orig_l2_err_disable);
 	edac_device_del_device(&op->dev);
-	edac_device_free_ctl_info(edac_dev);
 }
 
 static const struct of_device_id mpc85xx_l2_err_of_match[] = {
-- 
2.55.0