Unverified Commit 43cc5a0a authored by Yang Yingliang's avatar Yang Yingliang Committed by Mark Brown
Browse files

spi: Fix simplification of devm_spi_register_controller 



This reverts commit 59ebbe40 ("spi: simplify
devm_spi_register_controller").

If devm_add_action() fails in devm_add_action_or_reset(),
devm_spi_unregister() will be called, it decreases the
refcount of 'ctlr->dev' to 0, then it will cause uaf in
the drivers that calling spi_put_controller() in error path.

Fixes: 59ebbe40 ("spi: simplify devm_spi_register_controller")
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: default avatarConor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20220712135504.1055688-1-yangyingliang@huawei.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent cdb0cc93

drivers/spi/spi.c

+14 −5
Original line number Diff line number Diff line
@@ -3132,9 +3132,9 @@ int spi_register_controller(struct spi_controller *ctlr) 
}

EXPORT_SYMBOL_GPL(spi_register_controller);



static void devm_spi_unregister(void *ctlr)

static void devm_spi_unregister(struct device *dev, void *res)

{

	spi_unregister_controller(ctlr);

	spi_unregister_controller(*(struct spi_controller **)res);

}



/**
@@ -3153,13 +3153,22 @@ static void devm_spi_unregister(void *ctlr) 
int devm_spi_register_controller(struct device *dev,

				 struct spi_controller *ctlr)

{

	struct spi_controller **ptr;

	int ret;



	ptr = devres_alloc(devm_spi_unregister, sizeof(*ptr), GFP_KERNEL);

	if (!ptr)

		return -ENOMEM;



	ret = spi_register_controller(ctlr);

	if (ret)

		return ret;

	if (!ret) {

		*ptr = ctlr;

		devres_add(dev, ptr);

	} else {

		devres_free(ptr);

	}



	return devm_add_action_or_reset(dev, devm_spi_unregister, ctlr);

	return ret;

}

EXPORT_SYMBOL_GPL(devm_spi_register_controller);