hamza.kesraoui/sst-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

spi: cadence-quadspi: Remove spi_master_put() in probe failure path

Browse Source 
Currently the spi_master is allocated by devm_spi_alloc_master()
and devres core manages the deallocation, but in probe failure
path spi_master_put() is being handled manually which causes
"refcount underflow use-after-free" warning when probe failure happens
after allocating spi_master.

Trimmed backtrace during failure:

refcount_t: underflow; use-after-free.
pc : refcount_warn_saturate+0xf4/0x144
Call trace:
refcount_warn_saturate
kobject_put
put_device
devm_spi_release_controller
devres_release_all

This commit makes relevant changes to remove spi_master_put() from probe
failure path.

Fixes: 606e5d4081 ("spi: cadence-quadspi: Handle spi_unregister_master() in remove()")

Signed-off-by: Vaishnav Achath <vaishnav.a@ti.com>
Link: https://lore.kernel.org/r/20220601071611.11853-1-vaishnav.a@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Vaishnav Achath 2022-06-01 12:46:11 +05:30 committed by Mark Brown
parent a77c46f2b4
commit 73d5fe0462
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
1 changed files with 7 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
drivers/spi/spi-cadence-quadspi.c
View File

@ -1578,8 +1578,7 @@ static int cqspi_probe(struct platform_device *pdev)
ret = cqspi_of_get_pdata(cqspi); ret = cqspi_of_get_pdata(cqspi);
if (ret) { if (ret) {
dev_err(dev, "Cannot get mandatory OF data.\n"); dev_err(dev, "Cannot get mandatory OF data.\n");
ret = -ENODEV; return -ENODEV;
goto probe_master_put;
} }
/* Obtain QSPI clock. */ /* Obtain QSPI clock. */
@ -1587,7 +1586,7 @@ static int cqspi_probe(struct platform_device *pdev)
if (IS_ERR(cqspi->clk)) { if (IS_ERR(cqspi->clk)) {
dev_err(dev, "Cannot claim QSPI clock.\n"); dev_err(dev, "Cannot claim QSPI clock.\n");
ret = PTR_ERR(cqspi->clk); ret = PTR_ERR(cqspi->clk);
goto probe_master_put; return ret;
} }
/* Obtain and remap controller address. */ /* Obtain and remap controller address. */
@ -1596,7 +1595,7 @@ static int cqspi_probe(struct platform_device *pdev)
if (IS_ERR(cqspi->iobase)) { if (IS_ERR(cqspi->iobase)) {
dev_err(dev, "Cannot remap controller address.\n"); dev_err(dev, "Cannot remap controller address.\n");
ret = PTR_ERR(cqspi->iobase); ret = PTR_ERR(cqspi->iobase);
goto probe_master_put; return ret;
} }
/* Obtain and remap AHB address. */ /* Obtain and remap AHB address. */
@ -1605,7 +1604,7 @@ static int cqspi_probe(struct platform_device *pdev)
if (IS_ERR(cqspi->ahb_base)) { if (IS_ERR(cqspi->ahb_base)) {
dev_err(dev, "Cannot remap AHB address.\n"); dev_err(dev, "Cannot remap AHB address.\n");
ret = PTR_ERR(cqspi->ahb_base); ret = PTR_ERR(cqspi->ahb_base);
goto probe_master_put; return ret;
} }
cqspi->mmap_phys_base = (dma_addr_t)res_ahb->start; cqspi->mmap_phys_base = (dma_addr_t)res_ahb->start;
cqspi->ahb_size = resource_size(res_ahb); cqspi->ahb_size = resource_size(res_ahb);
@ -1614,15 +1613,13 @@ static int cqspi_probe(struct platform_device *pdev)
/* Obtain IRQ line. */ /* Obtain IRQ line. */
irq = platform_get_irq(pdev, 0); irq = platform_get_irq(pdev, 0);
if (irq < 0) { if (irq < 0)
ret = -ENXIO; return -ENXIO;
goto probe_master_put;
}
pm_runtime_enable(dev); pm_runtime_enable(dev);
ret = pm_runtime_resume_and_get(dev); ret = pm_runtime_resume_and_get(dev);
if (ret < 0) if (ret < 0)
goto probe_master_put; return ret;
ret = clk_prepare_enable(cqspi->clk); ret = clk_prepare_enable(cqspi->clk);
if (ret) { if (ret) {
@ -1716,8 +1713,6 @@ probe_reset_failed:
probe_clk_failed: probe_clk_failed:
pm_runtime_put_sync(dev); pm_runtime_put_sync(dev);
pm_runtime_disable(dev); pm_runtime_disable(dev);
probe_master_put:
spi_master_put(master);
return ret; return ret;
} }