kernel/linux.git/include/linux/spi/spi.h, branch v4.4.296

spi: Fix use-after-free with devm_spi_alloc_*

2021-06-03T06:22:06+00:00

commit 794aaf01444d4e765e2b067cba01cc69c1c68ed9 upstream. We can't rely on the contents of the devres list during spi_unregister_controller(), as the list is already torn down at the time we perform devres_find() for devm_spi_release_controller. This causes devices registered with devm_spi_alloc_{master,slave}() to be mistakenly identified as legacy, non-devm managed devices and have their reference counters decremented below 0. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174 [] (refcount_warn_saturate) from [] (kobject_put+0x90/0x98) [] (kobject_put) from [] (put_device+0x20/0x24) r4:b6700140 [] (put_device) from [] (devm_spi_release_controller+0x3c/0x40) [] (devm_spi_release_controller) from [] (release_nodes+0x84/0xc4) r5:b6700180 r4:b6700100 [] (release_nodes) from [] (devres_release_all+0x5c/0x60) r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10 [] (devres_release_all) from [] (__device_release_driver+0x144/0x1ec) r5:b117ad94 r4:b163dc10 [] (__device_release_driver) from [] (device_driver_detach+0x84/0xa0) r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10 [] (device_driver_detach) from [] (unbind_store+0xe4/0xf8) Instead, determine the devm allocation state as a flag on the controller which is guaranteed to be stable during cleanup. Fixes: 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation") Signed-off-by: William A. Kennington III Link: https://lore.kernel.org/r/20210407095527.2771582-1-wak@google.com Signed-off-by: Mark Brown [lukas: backport to v4.4.270] Signed-off-by: Lukas Wunner Signed-off-by: Greg Kroah-Hartman

spi: Introduce device-managed SPI controller allocation

2020-12-11T12:36:45+00:00

[ Upstream commit 5e844cc37a5cbaa460e68f9a989d321d63088a89 ] SPI driver probing currently comprises two steps, whereas removal comprises only one step: spi_alloc_master() spi_register_master() spi_unregister_master() That's because spi_unregister_master() calls device_unregister() instead of device_del(), thereby releasing the reference on the spi_master which was obtained by spi_alloc_master(). An SPI driver's private data is contained in the same memory allocation as the spi_master struct. Thus, once spi_unregister_master() has been called, the private data is inaccessible. But some drivers need to access it after spi_unregister_master() to perform further teardown steps. Introduce devm_spi_alloc_master(), which releases a reference on the spi_master struct only after the driver has unbound, thereby keeping the memory allocation accessible. Change spi_unregister_master() to not release a reference if the spi_master was allocated by the new devm function. The present commit is small enough to be backportable to stable. It allows fixing drivers which use the private data in their ->remove() hook after it's been freed. It also allows fixing drivers which neglect to release a reference on the spi_master in the probe error path. Long-term, most SPI drivers shall be moved over to the devm function introduced herein. The few that can't shall be changed in a treewide commit to explicitly release the last reference on the master. That commit shall amend spi_unregister_master() to no longer release a reference, thereby completing the migration. As a result, the behaviour will be less surprising and more consistent with subsystems such as IIO, which also includes the private data in the allocation of the generic iio_dev struct, but calls device_del() in iio_device_unregister(). Signed-off-by: Lukas Wunner Link: https://lore.kernel.org/r/272bae2ef08abd21388c98e23729886663d19192.1605121038.git.lukas@wunner.de Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman

Merge remote-tracking branches 'spi/topic/omap-100k', 'spi/topic/omap-uwire', 'spi/topic/owner', 'spi/topic/pxa' and 'spi/topic/pxa2xx' into spi-next

2015-11-04T11:02:12+00:00

spi: Add THIS_MODULE to spi_driver in SPI core

2015-10-28T01:30:12+00:00

Add spi_register_driver helper macro that adds THIS_MODULE to spi_driver for the registering driver. We rename and modify the existing spi_register_driver to enable this. Signed-off-by: Andrew F. Davis Signed-off-by: Mark Brown

spi: fix kernel-doc warnings about missing return desc in spi.h

2015-10-23T16:28:35+00:00

When building docs with make htmldocs, warnings about not having a description for the return value are reported, i.e: warning: No description found for return value of 'spi_write' Fix these by following the kernel-doc conventions explained in Documentation/kernel-doc-nano-HOWTO.txt. Signed-off-by: Javier Martinez Canillas Signed-off-by: Mark Brown

Merge branches 'topic/core' and 'topic/stats' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi into spi-doc

2015-10-23T16:28:29+00:00

spi: add transfer histogram statistics via sysfs

2015-09-19T18:12:56+00:00

report transfer sizes as a histogram via the following files: /sys/class/spi_master/spi*/statistics/transfer_bytes_histo_* /sys/class/spi_master/spi*/spi*.*/statistics/transfer_bytes_histo_* Signed-off-by: Martin Sperl Signed-off-by: Mark Brown

spi: fix kernel-doc warnings in spi.h

2015-09-16T19:44:47+00:00

Fix the following 'make htmldocs' warnings: .//include/linux/spi/spi.h:71: warning: No description found for parameter 'lock' .//include/linux/spi/spi.h:71: warning: Excess struct/union/enum/typedef member 'clock' description in 'spi_statistics' Signed-off-by: Geliang Tang Signed-off-by: Mark Brown

spi: expose spi_master and spi_device statistics via sysfs

2015-07-07T12:33:23+00:00

per spi-master statistics accessible as: /sys/class/spi_master/spi*/statistics/* per spi-device statistics accessible via: /sys/class/spi_master/spi*/spi*.*/statistics/* The following statistics are exposed as separate "files" inside these directories: * messages number of spi_messages * transfers number of spi_transfers * bytes number of bytes transferred * bytes_rx number of bytes transmitted * bytes_tx number of bytes received * errors number of errors encounterd * timedout number of messages that have timed out * spi_async number of spi_messages submitted using spi_async * spi_sync number of spi_messages submitted using spi_sync * spi_sync_immediate number of spi_messages submitted using spi_sync, that are handled immediately without a context switch to the spi_pump worker-thread Signed-off-by: Martin Sperl Signed-off-by: Mark Brown

Merge remote-tracking branches 'spi/topic/omap-100k', 'spi/topic/omap-uwire', 'spi/topic/pl022', 'spi/topic/pm' and 'spi/topic/pxa2xx' into spi-next

2015-04-11T22:09:18+00:00