Unverified Commit 8634e05b authored by Johan Hovold's avatar Johan Hovold Committed by Mark Brown
Browse files

spi: fix use-after-free on controller registration failure 



Make sure to deregister from driver core also in the unlikely event that
per-cpu statistics allocation fails during controller registration to
avoid use-after-free (of driver resources) and unclocked register
accesses.

Fixes: 6598b91b ("spi: spi.c: Convert statistics to per-cpu u64_stats_t")
Cc: stable@vger.kernel.org	# 6.0
Cc: David Jander <david@protonic.nl>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260312151817.32100-2-johan@kernel.org


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent ba3402f6

drivers/spi/spi.c

+4 −4
Original line number Diff line number Diff line
@@ -3480,10 +3480,8 @@ int spi_register_controller(struct spi_controller *ctlr) 
		dev_info(dev, "controller is unqueued, this is deprecated\n");

	} else if (ctlr->transfer_one || ctlr->transfer_one_message) {

		status = spi_controller_initialize_queue(ctlr);

		if (status) {

			device_del(&ctlr->dev);

			goto free_bus_id;

		}

		if (status)

			goto del_ctrl;

	}

	/* Add statistics */

	ctlr->pcpu_statistics = spi_alloc_pcpu_stats(dev);
@@ -3506,6 +3504,8 @@ int spi_register_controller(struct spi_controller *ctlr) 


destroy_queue:

	spi_destroy_queue(ctlr);

del_ctrl:

	device_del(&ctlr->dev);

free_bus_id:

	mutex_lock(&board_lock);

	idr_remove(&spi_controller_idr, ctlr->bus_num);