From a0ead24eb58795fafe99fb1e28e73805d703a836 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 14 May 2021 13:18:02 +0200 Subject: [PATCH] Revert "spi: Fix use-after-free with devm_spi_alloc_*" This reverts commit 001c8e83646ad3b847b18f6ac55a54367d917d74 which is commit 794aaf01444d4e765e2b067cba01cc69c1c68ed9 upstream as it breaks the kabi. This should not be needed for android devices as they do not remove SPI devices under normal operation. Bug: 161946584 Signed-off-by: Greg Kroah-Hartman Change-Id: I0909978867a4e4e7304fd0d21ebff77c35468cd3 --- drivers/spi/spi.c | 9 +++++++-- include/linux/spi/spi.h | 3 --- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 2b2be02f1a01..3853e99c8aa0 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -2291,7 +2291,6 @@ struct spi_controller *__devm_spi_alloc_controller(struct device *dev, ctlr = __spi_alloc_controller(dev, size, slave); if (ctlr) { - ctlr->devm_allocated = true; *ptr = ctlr; devres_add(dev, ptr); } else { @@ -2621,6 +2620,11 @@ int devm_spi_register_controller(struct device *dev, } EXPORT_SYMBOL_GPL(devm_spi_register_controller); +static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr) +{ + return *(struct spi_controller **)res == ctlr; +} + static int __unregister(struct device *dev, void *null) { spi_unregister_device(to_spi_device(dev)); @@ -2667,7 +2671,8 @@ void spi_unregister_controller(struct spi_controller *ctlr) /* Release the last reference on the controller if its driver * has not yet been converted to devm_spi_alloc_master/slave(). */ - if (!ctlr->devm_allocated) + if (!devres_find(ctlr->dev.parent, devm_spi_release_controller, + devm_spi_match_controller, ctlr)) put_device(&ctlr->dev); /* free bus id */ diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h index 7067f85cef0b..acd91300a4ab 100644 --- a/include/linux/spi/spi.h +++ b/include/linux/spi/spi.h @@ -466,9 +466,6 @@ struct spi_controller { #define SPI_MASTER_GPIO_SS BIT(5) /* GPIO CS must select slave */ - /* flag indicating this is a non-devres managed controller */ - bool devm_allocated; - /* flag indicating this is an SPI slave controller */ bool slave;