[PATCH] sf: dataflash: Don't free the SPI slave in the probe error path

[Yuho Choi <oss.patchbox@gmail.com>]

When the legacy status byte reports a density code that is not handled,
spi_dataflash_probe() calls spi_free_slave() and then spi_release_bus()
on the same slave.

spi_free_slave() calls device_remove() on slave->dev, which is the
device being probed. device_probe() has already set DM_FLAG_ACTIVATED
at this point, so with DM_DEVICE_REMOVE=y (the default in U-Boot
proper) the device is removed and device_free() frees its parent
private data, which is the struct spi_slave. spi_release_bus() then
reads slave->dev from freed memory and passes it to
dm_spi_release_bus().

This happens when the JEDEC ID read does not return the Atmel
manufacturer ID and the density code in the status byte matches none
of the supported legacy parts, e.g. 0x10 (AT45DB1282), which the driver
does not support.

The struct spi_slave is owned by the device, and device_probe() already
frees it when the probe fails. Drop the spi_free_slave() call so that
the error path only releases the bus. The add_dataflash() error check
used the same label. add_dataflash() always returns 0 at present, but
point it at err_jedec_probe as well so that the label can go.

Fixes: 11b93228a7c5 ("sf: dataflash: Fix add_dataflash return logic")
Assisted-by: LLM
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
---
Tested on sandbox only, with a test-only change (not part of this
patch) that adds an "atmel,at45" node and forces jedec_probe() to
return NULL and the status byte to 0x10. Without this patch, gdb shows
device_free() freeing the struct spi_slave before spi_release_bus()
reads slave->dev; with it, spi_release_bus() runs first and the struct
is freed once, by device_probe(). Not tested on hardware.

 drivers/mtd/spi/sf_dataflash.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/mtd/spi/sf_dataflash.c b/drivers/mtd/spi/sf_dataflash.c
index 9094e008f60..3651a585f7a 100644
--- a/drivers/mtd/spi/sf_dataflash.c
+++ b/drivers/mtd/spi/sf_dataflash.c
@@ -647,7 +647,7 @@ static int spi_dataflash_probe(struct udevice *dev)
 				info->pagesize, info->pageoffset,
 				(info->flags & SUP_POW2PS) ? 'd' : 'c');
 		if (status < 0)
-			goto err_status;
+			goto err_jedec_probe;
 		else
 			return status;
 	}
@@ -696,13 +696,11 @@ static int spi_dataflash_probe(struct udevice *dev)
 	default:
 		printf("dataflash: unsupported device (%x)\n", status & 0x3c);
 		status = -ENODEV;
-		goto err_status;
+		goto err_jedec_probe;
 	}
 
 	return status;
 
-err_status:
-	spi_free_slave(spi);
 err_jedec_probe:
 	spi_release_bus(spi);
 	return status;
-- 
2.43.0