user/sven/linux.git/include/linux/spi, branch v4.4.295

spi: Fix use-after-free with devm_spi_alloc_*

2021-06-03T06:22:06Z

commit 794aaf01444d4e765e2b067cba01cc69c1c68ed9 upstream. We can't rely on the contents of the devres list during spi_unregister_controller(), as the list is already torn down at the time we perform devres_find() for devm_spi_release_controller. This causes devices registered with devm_spi_alloc_{master,slave}() to be mistakenly identified as legacy, non-devm managed devices and have their reference counters decremented below 0. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174 [] (refcount_warn_saturate) from [] (kobject_put+0x90/0x98) [] (kobject_put) from [] (put_device+0x20/0x24) r4:b6700140 [] (put_device) from [] (devm_spi_release_controller+0x3c/0x40) [] (devm_spi_release_controller) from [] (release_nodes+0x84/0xc4) r5:b6700180 r4:b6700100 [] (release_nodes) from [] (devres_release_all+0x5c/0x60) r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10 [] (devres_release_all) from [] (__device_release_driver+0x144/0x1ec) r5:b117ad94 r4:b163dc10 [] (__device_release_driver) from [] (device_driver_detach+0x84/0xa0) r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10 [] (device_driver_detach) from [] (unbind_store+0xe4/0xf8) Instead, determine the devm allocation state as a flag on the controller which is guaranteed to be stable during cleanup. Fixes: 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation") Signed-off-by: William A. Kennington III Link: https://lore.kernel.org/r/20210407095527.2771582-1-wak@google.com Signed-off-by: Mark Brown [lukas: backport to v4.4.270] Signed-off-by: Lukas Wunner Signed-off-by: Greg Kroah-Hartman

spi: Introduce device-managed SPI controller allocation

2020-12-11T12:36:45Z

[ Upstream commit 5e844cc37a5cbaa460e68f9a989d321d63088a89 ] SPI driver probing currently comprises two steps, whereas removal comprises only one step: spi_alloc_master() spi_register_master() spi_unregister_master() That's because spi_unregister_master() calls device_unregister() instead of device_del(), thereby releasing the reference on the spi_master which was obtained by spi_alloc_master(). An SPI driver's private data is contained in the same memory allocation as the spi_master struct. Thus, once spi_unregister_master() has been called, the private data is inaccessible. But some drivers need to access it after spi_unregister_master() to perform further teardown steps. Introduce devm_spi_alloc_master(), which releases a reference on the spi_master struct only after the driver has unbound, thereby keeping the memory allocation accessible. Change spi_unregister_master() to not release a reference if the spi_master was allocated by the new devm function. The present commit is small enough to be backportable to stable. It allows fixing drivers which use the private data in their ->remove() hook after it's been freed. It also allows fixing drivers which neglect to release a reference on the spi_master in the probe error path. Long-term, most SPI drivers shall be moved over to the devm function introduced herein. The few that can't shall be changed in a treewide commit to explicitly release the last reference on the master. That commit shall amend spi_unregister_master() to no longer release a reference, thereby completing the migration. As a result, the behaviour will be less surprising and more consistent with subsystems such as IIO, which also includes the private data in the allocation of the generic iio_dev struct, but calls device_del() in iio_device_unregister(). Signed-off-by: Lukas Wunner Link: https://lore.kernel.org/r/272bae2ef08abd21388c98e23729886663d19192.1605121038.git.lukas@wunner.de Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman

Merge tag 'armsoc-cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

2015-11-10T22:48:36Z

Pull ARM SoC cleanups from Olof Johansson: "Again we have a sizable (but not huge) cleanup branch with a net delta of about -3k lines. Main contents here is: - A bunch of development/cleanup of a few PXA boards - Removal of bockw platforms on shmobile, since the platform has now gone completely multiplatform. Whee! - move of the 32kHz timer on OMAP to a proper timesource - Misc cleanup of older OMAP material (incl removal of one board file) - Switch over to new common PWM lookup support for several platforms There's also a handful of other cleanups across the tree, but the above are the major pieces" * tag 'armsoc-cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (103 commits) ARM: OMAP3: hwmod data: Remove legacy mailbox data and addrs ARM: DRA7: hwmod data: Remove spinlock hwmod addrs ARM: OMAP4: hwmod data: Remove spinlock hwmod addrs ARM: DRA7/AM335x/AM437x: hwmod: Remove gpmc address space from hwmod data ARM: Remove __ref on hotplug cpu die path ARM: Remove open-coded version of IRQCHIP_DECLARE arm: omap2: board-generic: use omap4_local_timer_init for AM437x ARM: DRA7/AM335x/AM437x: hwmod: Remove elm address space from hwmod data ARM: OMAP: Remove duplicated operand in OR operation clocksource: ti-32k: make it depend on GENERIC_CLOCKSOURCE ARM: pxa: remove incorrect __init annotation on pxa27x_set_pwrmode ARM: pxa: raumfeld: make some variables static ARM: OMAP: Change all cpu_is_* occurences to soc_is_* for id.c ARM: OMAP2+: Rename cpu_is macros to soc_is arm: omap2: timer: limit hwmod usage to non-DT boots arm: omap2+: select 32k clocksource driver clocksource: add TI 32.768 Hz counter driver arm: omap2: timer: rename omap_sync32k_timer_init() arm: omap2: timer: always call clocksource_of_init() when DT arm: omap2: timer: move realtime_counter_init() around ...

Merge remote-tracking branches 'spi/topic/omap-100k', 'spi/topic/omap-uwire', 'spi/topic/owner', 'spi/topic/pxa' and 'spi/topic/pxa2xx' into spi-next

2015-11-04T11:02:12Z

Merge remote-tracking branches 'spi/topic/bcm53xx', 'spi/topic/bcm63xx', 'spi/topic/bfin-sport', 'spi/topic/bfin5xx' and 'spi/topic/bitbang' into spi-next

2015-11-04T11:02:06Z

spi: Add THIS_MODULE to spi_driver in SPI core

2015-10-28T01:30:12Z

Add spi_register_driver helper macro that adds THIS_MODULE to spi_driver for the registering driver. We rename and modify the existing spi_register_driver to enable this. Signed-off-by: Andrew F. Davis Signed-off-by: Mark Brown

Merge tag 'pxa-for-4.4' of https://github.com/rjarzmik/linux into next/cleanup

2015-10-23T17:15:03Z

This is the pxa changes for v4.4 cycle. This cycle is bigger than usual : - magician was greatly enhanced (new IPs discovered, ...) - almost all legacy board files have been updated to the new PWM API (mostly for backlight control) - some minor fixes in raumfeld, z2 and mioa701 * tag 'pxa-for-4.4' of https://github.com/rjarzmik/linux: (44 commits) ARM: pxa: remove incorrect __init annotation on pxa27x_set_pwrmode ARM: pxa: raumfeld: make some variables static ARM: pxa: magician: Remove pdata for pasic3-leds ARM: pxa: magician: Add support for PXA27x UDC ARM: pxa: magician: Add support for MAX1587A Vcore regulator ARM: pxa: magician: Change comments to be more informative ARM: pxa: magician: Move platform_add_devices() to the end of magician_init() ARM: pxa: magician: Add missing regulator for PWM backlight ARM: pxa: magician: Add debug message for backlight brightness function ARM: pxa: magician: Remove definition of the STUART port ARM: pxa: magician: Fix wrongly enabled USB host ports ARM: pxa: magician: Fix support for Intel Strata NOR Flash ARM: pxa: magician: Fix redundant GPIO request for pxaficp_ir ARM: pxa: magician: Fix platform data for both PXA27x I2C controllers ARM: pxa: magician: Fix and add charging detection functions ARM: pxa: magician: Optimize Samsung LCD refresh to 50Hz ARM: pxa: magician: Rename charger cable detection EGPIOs ARM: pxa: magician: Optimize powerup delays for Samsung LCD ARM: pxa: magician: Rename abstract LCD GPIOs ARM: pxa: magician: Add new discovered EGPIO pins ... Signed-off-by: Olof Johansson

spi: fix kernel-doc warnings about missing return desc in spi.h

2015-10-23T16:28:35Z

When building docs with make htmldocs, warnings about not having a description for the return value are reported, i.e: warning: No description found for return value of 'spi_write' Fix these by following the kernel-doc conventions explained in Documentation/kernel-doc-nano-HOWTO.txt. Signed-off-by: Javier Martinez Canillas Signed-off-by: Mark Brown

Merge branches 'topic/core' and 'topic/stats' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi into spi-doc

2015-10-23T16:28:29Z

ARM: pxa: Remove unused clock_enable field from struct pxa2xx_spi_master

2015-09-20T17:37:20Z

Use for struct pxa2xx_spi_master clock_enable field was removed years ago from the pxa2xx-spi driver by the commit 2f1a74e5a2de ("[ARM] pxa: make pxa2xx_spi driver use ssp_request()/ssp_free()"). Therefore remove it from structure definition, documentation and from couple affected board files. Signed-off-by: Jarkko Nikula Acked-by: Mark Brown Signed-off-by: Robert Jarzmik