Unverified Commit 73d5fe04 authored by Vaishnav Achath's avatar Vaishnav Achath Committed by Mark Brown
Browse files

spi: cadence-quadspi: Remove spi_master_put() in probe failure path 



Currently the spi_master is allocated by devm_spi_alloc_master()
and devres core manages the deallocation, but in probe failure
path spi_master_put() is being handled manually which causes
"refcount underflow use-after-free" warning when probe failure happens
after allocating spi_master.

Trimmed backtrace during failure:

refcount_t: underflow; use-after-free.
pc : refcount_warn_saturate+0xf4/0x144
Call trace:
refcount_warn_saturate
kobject_put
put_device
devm_spi_release_controller
devres_release_all

This commit makes relevant changes to remove spi_master_put() from probe
failure path.

Fixes: 606e5d40 ("spi: cadence-quadspi: Handle spi_unregister_master() in remove()")

Signed-off-by: default avatarVaishnav Achath <vaishnav.a@ti.com>
Link: https://lore.kernel.org/r/20220601071611.11853-1-vaishnav.a@ti.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent a77c46f2

drivers/spi/spi-cadence-quadspi.c

+7 −12
Original line number Diff line number Diff line
@@ -1578,8 +1578,7 @@ static int cqspi_probe(struct platform_device *pdev) 
	ret = cqspi_of_get_pdata(cqspi);

	if (ret) {

		dev_err(dev, "Cannot get mandatory OF data.\n");

		ret = -ENODEV;

		goto probe_master_put;

		return -ENODEV;

	}



	/* Obtain QSPI clock. */
@@ -1587,7 +1586,7 @@ static int cqspi_probe(struct platform_device *pdev) 
	if (IS_ERR(cqspi->clk)) {

		dev_err(dev, "Cannot claim QSPI clock.\n");

		ret = PTR_ERR(cqspi->clk);

		goto probe_master_put;

		return ret;

	}



	/* Obtain and remap controller address. */
@@ -1596,7 +1595,7 @@ static int cqspi_probe(struct platform_device *pdev) 
	if (IS_ERR(cqspi->iobase)) {

		dev_err(dev, "Cannot remap controller address.\n");

		ret = PTR_ERR(cqspi->iobase);

		goto probe_master_put;

		return ret;

	}



	/* Obtain and remap AHB address. */
@@ -1605,7 +1604,7 @@ static int cqspi_probe(struct platform_device *pdev) 
	if (IS_ERR(cqspi->ahb_base)) {

		dev_err(dev, "Cannot remap AHB address.\n");

		ret = PTR_ERR(cqspi->ahb_base);

		goto probe_master_put;

		return ret;

	}

	cqspi->mmap_phys_base = (dma_addr_t)res_ahb->start;

	cqspi->ahb_size = resource_size(res_ahb);
@@ -1614,15 +1613,13 @@ static int cqspi_probe(struct platform_device *pdev) 


	/* Obtain IRQ line. */

	irq = platform_get_irq(pdev, 0);

	if (irq < 0) {

		ret = -ENXIO;

		goto probe_master_put;

	}

	if (irq < 0)

		return -ENXIO;



	pm_runtime_enable(dev);

	ret = pm_runtime_resume_and_get(dev);

	if (ret < 0)

		goto probe_master_put;

		return ret;



	ret = clk_prepare_enable(cqspi->clk);

	if (ret) {
@@ -1716,8 +1713,6 @@ static int cqspi_probe(struct platform_device *pdev) 
probe_clk_failed:

	pm_runtime_put_sync(dev);

	pm_runtime_disable(dev);

probe_master_put:

	spi_master_put(master);

	return ret;

}