From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> mainline inclusion from mainline-v5.19-rc1 commit 19368f0f23e80929691dd5b1354832c0e0494419 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14224 CVE: CVE-2026-31487 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Use a helper to set driver_override to the reduce amount of duplicated code. Reviewed-by: Mark Brown <broonie@kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20220419113435.246203-8-krzysztof.kozlowski@linaro... Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Conflicts: include/linux/spi/spi.h drivers/spi/spi.c [Comment conflict with no functional impact] Signed-off-by: Zhang Yuwei <zhangyuwei20@huawei.com> --- drivers/spi/spi.c | 26 ++++---------------------- include/linux/spi/spi.h | 2 ++ 2 files changed, 6 insertions(+), 22 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index a3a54240eaf5..891a44b2c59f 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -71,29 +71,11 @@ static ssize_t driver_override_store(struct device *dev, const char *buf, size_t count) { struct spi_device *spi = to_spi_device(dev); - const char *end = memchr(buf, '\n', count); - const size_t len = end ? end - buf : count; - const char *driver_override, *old; - - /* We need to keep extra room for a newline when displaying value */ - if (len >= (PAGE_SIZE - 1)) - return -EINVAL; - - driver_override = kstrndup(buf, len, GFP_KERNEL); - if (!driver_override) - return -ENOMEM; + int ret; - device_lock(dev); - old = spi->driver_override; - if (len) { - spi->driver_override = driver_override; - } else { - /* Empty string, disable driver override */ - spi->driver_override = NULL; - kfree(driver_override); - } - device_unlock(dev); - kfree(old); + ret = driver_set_override(dev, (char **)&spi->driver_override, buf, count); + if (ret) + return ret; return count; } diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h index ab7747549d23..96070247ba4c 100644 --- a/include/linux/spi/spi.h +++ b/include/linux/spi/spi.h @@ -137,6 +137,8 @@ extern int spi_delay_exec(struct spi_delay *_delay, struct spi_transfer *xfer); * for driver coldplugging, and in uevents used for hotplugging * @driver_override: If the name of a driver is written to this attribute, then * the device will bind to the named driver and only the named driver. + * Do not set directly, because core frees it; use driver_set_override() to + * set or clear it. * @cs_gpio: LEGACY: gpio number of the chipselect line (optional, -ENOENT when * not using a GPIO line) use cs_gpiod in new drivers by opting in on * the spi_master. -- 2.22.0