Patch "spi: bcm2835: Fix use-after-free on unbind" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    spi: bcm2835: Fix use-after-free on unbind

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     spi-bcm2835-fix-use-after-free-on-unbind.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 132879f8d0bcc302281d61812694e43f147a141c
Author: Lukas Wunner <lukas@xxxxxxxxx>
Date:   Wed Nov 11 20:07:20 2020 +0100

    spi: bcm2835: Fix use-after-free on unbind
    
    [ Upstream commit e1483ac030fb4c57734289742f1c1d38dca61e22 ]
    
    bcm2835_spi_remove() accesses the driver's private data after calling
    spi_unregister_controller() even though that function releases the last
    reference on the spi_controller and thereby frees the private data.
    
    Fix by switching over to the new devm_spi_alloc_master() helper which
    keeps the private data accessible until the driver has unbound.
    
    Fixes: f8043872e796 ("spi: add driver for BCM2835")
    Reported-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx>
    Reported-by: Florian Fainelli <f.fainelli@xxxxxxxxx>
    Signed-off-by: Lukas Wunner <lukas@xxxxxxxxx>
    Cc: <stable@xxxxxxxxxxxxxxx> # v3.10+: 123456789abc: spi: Introduce device-managed SPI controller allocation
    Cc: <stable@xxxxxxxxxxxxxxx> # v3.10+
    Cc: Vladimir Oltean <olteanv@xxxxxxxxx>
    Tested-by: Florian Fainelli <f.fainelli@xxxxxxxxx>
    Acked-by: Florian Fainelli <f.fainelli@xxxxxxxxx>
    Link: https://lore.kernel.org/r/ad66e0a0ad96feb848814842ecf5b6a4539ef35c.1605121038.git.lukas@xxxxxxxxx
    Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index a701e8c7fc926..a1969edb98ad0 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -1264,7 +1264,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
 	struct bcm2835_spi *bs;
 	int err;
 
-	ctlr = spi_alloc_master(&pdev->dev, ALIGN(sizeof(*bs),
+	ctlr = devm_spi_alloc_master(&pdev->dev, ALIGN(sizeof(*bs),
 						  dma_get_cache_alignment()));
 	if (!ctlr)
 		return -ENOMEM;
@@ -1284,23 +1284,17 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
 	bs = spi_controller_get_devdata(ctlr);
 
 	bs->regs = devm_platform_ioremap_resource(pdev, 0);
-	if (IS_ERR(bs->regs)) {
-		err = PTR_ERR(bs->regs);
-		goto out_controller_put;
-	}
+	if (IS_ERR(bs->regs))
+		return PTR_ERR(bs->regs);
 
 	bs->clk = devm_clk_get(&pdev->dev, NULL);
-	if (IS_ERR(bs->clk)) {
-		err = dev_err_probe(&pdev->dev, PTR_ERR(bs->clk),
-				    "could not get clk\n");
-		goto out_controller_put;
-	}
+	if (IS_ERR(bs->clk))
+		return dev_err_probe(&pdev->dev, PTR_ERR(bs->clk),
+				     "could not get clk\n");
 
 	bs->irq = platform_get_irq(pdev, 0);
-	if (bs->irq <= 0) {
-		err = bs->irq ? bs->irq : -ENODEV;
-		goto out_controller_put;
-	}
+	if (bs->irq <= 0)
+		return bs->irq ? bs->irq : -ENODEV;
 
 	clk_prepare_enable(bs->clk);
 
@@ -1330,8 +1324,6 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
 
 out_clk_disable:
 	clk_disable_unprepare(bs->clk);
-out_controller_put:
-	spi_controller_put(ctlr);
 	return err;
 }