This is a note to let you know that I've just added the patch titled mtd: spi-nor: core: Fix an issue of releasing resources during read/write to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mtd-spi-nor-core-fix-an-issue-of-releasing-resources-during-read-write.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From be94215be1ab19e5d38f50962f611c88d4bfc83a Mon Sep 17 00:00:00 2001 From: Xiang Chen <chenxiang66@xxxxxxxxxxxxx> Date: Thu, 1 Apr 2021 15:34:46 +0800 Subject: mtd: spi-nor: core: Fix an issue of releasing resources during read/write From: Xiang Chen <chenxiang66@xxxxxxxxxxxxx> commit be94215be1ab19e5d38f50962f611c88d4bfc83a upstream. If rmmod the driver during read or write, the driver will release the resources which are used during read or write, so it is possible to refer to NULL pointer. Use the testcase "mtd_debug read /dev/mtd0 0xc00000 0x400000 dest_file & sleep 0.5;rmmod spi_hisi_sfc_v3xx.ko", the issue can be reproduced in hisi_sfc_v3xx driver. To avoid the issue, fill the interface _get_device and _put_device of mtd_info to grab the reference to the spi controller driver module, so the request of rmmod the driver is rejected before read/write is finished. Fixes: b199489d37b2 ("mtd: spi-nor: add the framework for SPI NOR") Signed-off-by: Xiang Chen <chenxiang66@xxxxxxxxxxxxx> Signed-off-by: Yicong Yang <yangyicong@xxxxxxxxxxxxx> Signed-off-by: Tudor Ambarus <tudor.ambarus@xxxxxxxxxxxxx> Tested-by: Michael Walle <michael@xxxxxxxx> Tested-by: Tudor Ambarus <tudor.ambarus@xxxxxxxxxxxxx> Reviewed-by: Michael Walle <michael@xxxxxxxx> Cc: stable@xxxxxxxxxxxxxxx Link: https://lore.kernel.org/r/1617262486-4223-1-git-send-email-yangyicong@xxxxxxxxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/mtd/spi-nor/core.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) --- a/drivers/mtd/spi-nor/core.c +++ b/drivers/mtd/spi-nor/core.c @@ -2981,6 +2981,37 @@ static void spi_nor_resume(struct mtd_in dev_err(dev, "resume() failed\n"); } +static int spi_nor_get_device(struct mtd_info *mtd) +{ + struct mtd_info *master = mtd_get_master(mtd); + struct spi_nor *nor = mtd_to_spi_nor(master); + struct device *dev; + + if (nor->spimem) + dev = nor->spimem->spi->controller->dev.parent; + else + dev = nor->dev; + + if (!try_module_get(dev->driver->owner)) + return -ENODEV; + + return 0; +} + +static void spi_nor_put_device(struct mtd_info *mtd) +{ + struct mtd_info *master = mtd_get_master(mtd); + struct spi_nor *nor = mtd_to_spi_nor(master); + struct device *dev; + + if (nor->spimem) + dev = nor->spimem->spi->controller->dev.parent; + else + dev = nor->dev; + + module_put(dev->driver->owner); +} + void spi_nor_restore(struct spi_nor *nor) { /* restore the addressing mode */ @@ -3157,6 +3188,8 @@ int spi_nor_scan(struct spi_nor *nor, co mtd->_erase = spi_nor_erase; mtd->_read = spi_nor_read; mtd->_resume = spi_nor_resume; + mtd->_get_device = spi_nor_get_device; + mtd->_put_device = spi_nor_put_device; if (nor->params->locking_ops) { mtd->_lock = spi_nor_lock; Patches currently in stable-queue which might be from chenxiang66@xxxxxxxxxxxxx are queue-5.10/mtd-spi-nor-core-fix-an-issue-of-releasing-resources-during-read-write.patch