From 18593eb97f57ce4e4f98a8452633013725a10b89 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 14 May 2021 13:18:02 +0200 Subject: [PATCH] Revert "spi: Fix use-after-free with devm_spi_alloc_*" This reverts commit c7fabe372a9031acd00498bc718ce27c253abfd1 which is commit 794aaf01444d4e765e2b067cba01cc69c1c68ed9 upstream as it breaks the kabi. This should not be needed for android devices as they do not remove SPI devices under normal operation. Bug: 161946584 Signed-off-by: Greg Kroah-Hartman Change-Id: I0909978867a4e4e7304fd0d21ebff77c35468cd3 --- drivers/spi/spi.c | 9 +++++++-- include/linux/spi/spi.h | 3 --- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 4d23ab50a258..eee73ecefe6c 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -2481,7 +2481,6 @@ struct spi_controller *__devm_spi_alloc_controller(struct device *dev, ctlr = __spi_alloc_controller(dev, size, slave); if (ctlr) { - ctlr->devm_allocated = true; *ptr = ctlr; devres_add(dev, ptr); } else { @@ -2828,6 +2827,11 @@ int devm_spi_register_controller(struct device *dev, } EXPORT_SYMBOL_GPL(devm_spi_register_controller); +static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr) +{ + return *(struct spi_controller **)res == ctlr; +} + static int __unregister(struct device *dev, void *null) { spi_unregister_device(to_spi_device(dev)); @@ -2874,7 +2878,8 @@ void spi_unregister_controller(struct spi_controller *ctlr) /* Release the last reference on the controller if its driver * has not yet been converted to devm_spi_alloc_master/slave(). */ - if (!ctlr->devm_allocated) + if (!devres_find(ctlr->dev.parent, devm_spi_release_controller, + devm_spi_match_controller, ctlr)) put_device(&ctlr->dev); /* free bus id */ diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h index 2d906b9c1499..b390fdac1587 100644 --- a/include/linux/spi/spi.h +++ b/include/linux/spi/spi.h @@ -511,9 +511,6 @@ struct spi_controller { #define SPI_MASTER_GPIO_SS BIT(5) /* GPIO CS must select slave */ - /* flag indicating this is a non-devres managed controller */ - bool devm_allocated; - /* flag indicating this is an SPI slave controller */ bool slave;