Patch "spi: lpspi: Avoid potential use-after-free in probe()" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    spi: lpspi: Avoid potential use-after-free in probe()

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     spi-lpspi-avoid-potential-use-after-free-in-probe.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 45493496a0c5d610d6b68470dce44938fb461cfd
Author: Alexander Sverdlin <alexander.sverdlin@xxxxxxxxxxx>
Date:   Tue Mar 12 12:20:48 2024 +0100

    spi: lpspi: Avoid potential use-after-free in probe()
    
    [ Upstream commit 2ae0ab0143fcc06190713ed81a6486ed0ad3c861 ]
    
    fsl_lpspi_probe() is allocating/disposing memory manually with
    spi_alloc_host()/spi_alloc_target(), but uses
    devm_spi_register_controller(). In case of error after the latter call the
    memory will be explicitly freed in the probe function by
    spi_controller_put() call, but used afterwards by "devm" management outside
    probe() (spi_unregister_controller() <- devm_spi_unregister() below).
    
    Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070
    ...
    Call trace:
     kernfs_find_ns
     kernfs_find_and_get_ns
     sysfs_remove_group
     sysfs_remove_groups
     device_remove_attrs
     device_del
     spi_unregister_controller
     devm_spi_unregister
     release_nodes
     devres_release_all
     really_probe
     driver_probe_device
     __device_attach_driver
     bus_for_each_drv
     __device_attach
     device_initial_probe
     bus_probe_device
     deferred_probe_work_func
     process_one_work
     worker_thread
     kthread
     ret_from_fork
    
    Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
    Signed-off-by: Alexander Sverdlin <alexander.sverdlin@xxxxxxxxxxx>
    Link: https://msgid.link/r/20240312112050.2503643-1-alexander.sverdlin@xxxxxxxxxxx
    Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
index 11991eb126364..079035db7dd85 100644
--- a/drivers/spi/spi-fsl-lpspi.c
+++ b/drivers/spi/spi-fsl-lpspi.c
@@ -830,11 +830,11 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
 
 	is_target = of_property_read_bool((&pdev->dev)->of_node, "spi-slave");
 	if (is_target)
-		controller = spi_alloc_target(&pdev->dev,
-					      sizeof(struct fsl_lpspi_data));
+		controller = devm_spi_alloc_target(&pdev->dev,
+						   sizeof(struct fsl_lpspi_data));
 	else
-		controller = spi_alloc_host(&pdev->dev,
-					    sizeof(struct fsl_lpspi_data));
+		controller = devm_spi_alloc_host(&pdev->dev,
+						 sizeof(struct fsl_lpspi_data));
 
 	if (!controller)
 		return -ENOMEM;