tree 5dc12d0b7384f13f808617af22e052d54e96b14d
parent 4def49da620c84a682d9361d6bef0a97eed46fe0
parent 63c5395bb7a9777a33f0e7b5906f2c0170a23692
author Mark Brown <broonie@kernel.org> 1605209692 +0000
committer Mark Brown <broonie@kernel.org> 1605209692 +0000
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAl+tjl0ACgkQJNaLcl1U
 h9CbsQf+PhhRwZ0+pVAg/cecD6kcly+0Rm2mGCe5tKUmD3BgrNA7sqYtQV4lNXti
 cJloPbJEo1Xmc/P5RKhsMNfpdNYOudRDgkRlpsxDIp5egybPpYuBJRGluYq+0D/P
 EACzQWU2dBK02d0UyIaCVPVAkHIYNW7ZvdeXMyaSYl3oaXsLn8Pu9NR2MY7CIjdi
 EpbmgdSIypDchwRdm+8cNstCaUc1eL/CtfKiPktfzH3UPEqaHah8w+wcWDiHdfbA
 5IMBCC9I+DpTNnuzQhXIdKIkiNC0NKC4IzLy5QCQ+cwoBoca27eixkwJv61BCwdm
 j9YJmF3zvUbvsJwJTH2aECyG8r0f8g==
 =VBo6
 -----END PGP SIGNATURE-----

Merge series "Use-after-free be gone" from Lukas Wunner <lukas@wunner.de>:

Here's my proposal to fix the use-after-free bugs reported by
Sascha Hauer and Florian Fainelli:

I scrutinized all SPI drivers in the v5.10 tree:

* There are 9 drivers with a use-after-free in the ->remove() hook
  caused by accessing driver private data after spi_unregister_controller().

* There are 8 drivers which leak the spi_controller in the ->probe()
  error path because of a missing spi_controller_put().

I'm introducing devm_spi_alloc_master/slave() which automatically
calls spi_controller_put() on ->remove().  This fixes both classes
of bugs while at the same time reducing code amount and complexity
in the ->probe() hook.

I propose that spi_controller_unregister() should no longer release
a reference on the spi_controller.  Instead, drivers need to either
do it themselves or use one of the devm functions introduced herein.
The vast majority of drivers can be converted to the devm functions.
See the commit message of patch [1/4] for the rationale and details.

Enclosed are patches for 3 Broadcom drivers.
Patches for the other drivers are on this branch:
https://github.com/l1k/linux/commits/spi_fixes

@Florian Fainelli:  Could you verify that there are no KASAN splats or
leaks with these patches?  Unfortunately I do not have any SPI-capable
hardware at my disposal right now, so can only compile-test.  You may
want to augment spi_controller_release() with a printk() to log when
the spi_controller is freed.

@Mark Brown:  Patches [2/4] to [4/4] reference the SHA-1 of patch [1/4]
in their stable tags.  Because the hash is unknown to me until you apply
the patch, I've used "123456789abc" as a placeholder.  You'll have to
replace the hash if/when applying.  Alternatively, only apply patch [1/4]
and I'll repost the other patches with the hash fixed up.

Thanks!

Lukas Wunner (4):
  spi: Introduce device-managed SPI controller allocation
  spi: bcm2835: Fix use-after-free on unbind
  spi: bcm2835aux: Fix use-after-free on unbind
  spi: bcm-qspi: Fix use-after-free on unbind

 drivers/spi/spi-bcm-qspi.c   | 34 ++++++++-------------
 drivers/spi/spi-bcm2835.c    | 24 +++++----------
 drivers/spi/spi-bcm2835aux.c | 21 +++++--------
 drivers/spi/spi.c            | 58 +++++++++++++++++++++++++++++++++++-
 include/linux/spi/spi.h      | 19 ++++++++++++
 5 files changed, 103 insertions(+), 53 deletions(-)

--
2.28.0