From: Vaishnav Achath vaishnav.a@ti.com
mainline inclusion from mainline-v5.19-rc7 commit 73d5fe046270281a46344e06bf986c607632f7ea category: bugfix bugzilla: 189766 CVE: CVE-2024-26807
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
Currently the spi_master is allocated by devm_spi_alloc_master() and devres core manages the deallocation, but in probe failure path spi_master_put() is being handled manually which causes "refcount underflow use-after-free" warning when probe failure happens after allocating spi_master.
Trimmed backtrace during failure:
refcount_t: underflow; use-after-free. pc : refcount_warn_saturate+0xf4/0x144 Call trace: refcount_warn_saturate kobject_put put_device devm_spi_release_controller devres_release_all
This commit makes relevant changes to remove spi_master_put() from probe failure path.
Fixes: 606e5d408184 ("spi: cadence-quadspi: Handle spi_unregister_master() in remove()")
Signed-off-by: Vaishnav Achath vaishnav.a@ti.com Link: https://lore.kernel.org/r/20220601071611.11853-1-vaishnav.a@ti.com Signed-off-by: Mark Brown broonie@kernel.org Conflicts: drivers/spi/spi-cadence-quadspi.c Signed-off-by: Liao Chen liaochen4@huawei.com --- drivers/spi/spi-cadence-quadspi.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-)
diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c index 392d20ead254..041e651eaebf 100644 --- a/drivers/spi/spi-cadence-quadspi.c +++ b/drivers/spi/spi-cadence-quadspi.c @@ -1205,8 +1205,7 @@ static int cqspi_probe(struct platform_device *pdev) ret = cqspi_of_get_pdata(cqspi); if (ret) { dev_err(dev, "Cannot get mandatory OF data.\n"); - ret = -ENODEV; - goto probe_master_put; + return -ENODEV; }
/* Obtain QSPI clock. */ @@ -1214,7 +1213,7 @@ static int cqspi_probe(struct platform_device *pdev) if (IS_ERR(cqspi->clk)) { dev_err(dev, "Cannot claim QSPI clock.\n"); ret = PTR_ERR(cqspi->clk); - goto probe_master_put; + return ret; }
/* Obtain and remap controller address. */ @@ -1223,7 +1222,7 @@ static int cqspi_probe(struct platform_device *pdev) if (IS_ERR(cqspi->iobase)) { dev_err(dev, "Cannot remap controller address.\n"); ret = PTR_ERR(cqspi->iobase); - goto probe_master_put; + return ret; }
/* Obtain and remap AHB address. */ @@ -1232,7 +1231,7 @@ static int cqspi_probe(struct platform_device *pdev) if (IS_ERR(cqspi->ahb_base)) { dev_err(dev, "Cannot remap AHB address.\n"); ret = PTR_ERR(cqspi->ahb_base); - goto probe_master_put; + return ret; } cqspi->mmap_phys_base = (dma_addr_t)res_ahb->start; cqspi->ahb_size = resource_size(res_ahb); @@ -1241,17 +1240,13 @@ static int cqspi_probe(struct platform_device *pdev)
/* Obtain IRQ line. */ irq = platform_get_irq(pdev, 0); - if (irq < 0) { + if (irq < 0) ret = -ENXIO; - goto probe_master_put; - }
pm_runtime_enable(dev); ret = pm_runtime_get_sync(dev); - if (ret < 0) { - pm_runtime_put_noidle(dev); - goto probe_master_put; - } + if (ret < 0) + return ret;
ret = clk_prepare_enable(cqspi->clk); if (ret) { @@ -1330,8 +1325,6 @@ static int cqspi_probe(struct platform_device *pdev) probe_clk_failed: pm_runtime_put_sync(dev); pm_runtime_disable(dev); -probe_master_put: - spi_master_put(master); return ret; }