Unverified Commit 383d4f5c authored by Felix Gu's avatar Felix Gu Committed by Mark Brown
Browse files

spi: spi-sprd-adi: Fix double free in probe error path 



The driver currently uses spi_alloc_host() to allocate the controller
but registers it using devm_spi_register_controller().

If devm_register_restart_handler() fails, the code jumps to the
put_ctlr label and calls spi_controller_put(). However, since the
controller was registered via a devm function, the device core will
automatically call spi_controller_put() again when the probe fails.
This results in a double-free of the spi_controller structure.

Fix this by switching to devm_spi_alloc_host() and removing the
manual spi_controller_put() call.

Fixes: ac177501 ("spi: sprd: Add the support of restarting the system")
Signed-off-by: default avatarFelix Gu <gu_0233@qq.com>
Reviewed-by: default avatarBaolin Wang <baolin.wang@linux.alibaba.com>
Link: https://patch.msgid.link/tencent_AC7D389CE7E24318445E226F7CDCCC2F0D07@qq.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 9ace4753

drivers/spi/spi-sprd-adi.c

+10 −23
Original line number Diff line number Diff line
@@ -528,7 +528,7 @@ static int sprd_adi_probe(struct platform_device *pdev) 
	pdev->id = of_alias_get_id(np, "spi");

	num_chipselect = of_get_child_count(np);



	ctlr = spi_alloc_host(&pdev->dev, sizeof(struct sprd_adi));

	ctlr = devm_spi_alloc_host(&pdev->dev, sizeof(struct sprd_adi));

	if (!ctlr)

		return -ENOMEM;
@@ -536,10 +536,8 @@ static int sprd_adi_probe(struct platform_device *pdev) 
	sadi = spi_controller_get_devdata(ctlr);



	sadi->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);

	if (IS_ERR(sadi->base)) {

		ret = PTR_ERR(sadi->base);

		goto put_ctlr;

	}

	if (IS_ERR(sadi->base))

		return PTR_ERR(sadi->base);



	sadi->slave_vbase = (unsigned long)sadi->base +

			    data->slave_offset;
@@ -551,18 +549,15 @@ static int sprd_adi_probe(struct platform_device *pdev) 
	if (ret > 0 || (IS_ENABLED(CONFIG_HWSPINLOCK) && ret == 0)) {

		sadi->hwlock =

			devm_hwspin_lock_request_specific(&pdev->dev, ret);

		if (!sadi->hwlock) {

			ret = -ENXIO;

			goto put_ctlr;

		}

		if (!sadi->hwlock)

			return -ENXIO;

	} else {

		switch (ret) {

		case -ENOENT:

			dev_info(&pdev->dev, "no hardware spinlock supplied\n");

			break;

		default:

			dev_err_probe(&pdev->dev, ret, "failed to find hwlock id\n");

			goto put_ctlr;

			return dev_err_probe(&pdev->dev, ret, "failed to find hwlock id\n");

		}

	}
@@ -579,26 +574,18 @@ static int sprd_adi_probe(struct platform_device *pdev) 
	ctlr->transfer_one = sprd_adi_transfer_one;



	ret = devm_spi_register_controller(&pdev->dev, ctlr);

	if (ret) {

		dev_err(&pdev->dev, "failed to register SPI controller\n");

		goto put_ctlr;

	}

	if (ret)

		return dev_err_probe(&pdev->dev, ret, "failed to register SPI controller\n");



	if (sadi->data->restart) {

		ret = devm_register_restart_handler(&pdev->dev,

						    sadi->data->restart,

						    sadi);

		if (ret) {

			dev_err(&pdev->dev, "can not register restart handler\n");

			goto put_ctlr;

		}

		if (ret)

			return dev_err_probe(&pdev->dev, ret, "can not register restart handler\n");

	}



	return 0;



put_ctlr:

	spi_controller_put(ctlr);

	return ret;

}



static struct sprd_adi_data sc9860_data = {