From patchwork Mon Jun 1 13:39:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 209035 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD8A8C433E1 for ; Mon, 1 Jun 2020 13:40:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B63C32068D for ; Mon, 1 Jun 2020 13:40:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591018852; bh=CH8mGaZuzQ5m7qqlMmRJHYj9IYXYPPQsL/Bu0PcJM1A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=jdv4q6fJ7refDq5xMePiiELg3QcNbAhNwSB22DEI5fTv00MgKcB/qZWaPtHmMplfK sMXSTZCu5O/XtT+eG6h/uGmNtsmC9N+lmm0141t5QASeTMbdHPXu81WbcQlIk9RZSN jiGqRLcZQ9IxjnaIa5YgOPOdOijMO0ll0nYEZmN0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727118AbgFANkr (ORCPT ); Mon, 1 Jun 2020 09:40:47 -0400 Received: from mail-lj1-f196.google.com ([209.85.208.196]:40825 "EHLO mail-lj1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726201AbgFANk3 (ORCPT ); Mon, 1 Jun 2020 09:40:29 -0400 Received: by mail-lj1-f196.google.com with SMTP id z13so8163846ljn.7; Mon, 01 Jun 2020 06:40:25 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9WLwaacWxVJgJAQUy6rPeyp9VmCZjz1WJ6juENBmuJI=; b=L7DfhdlbTpPGL9COo0M27WG8/lt1F6mLb4/oVZ45DzZDxQyGFP2OxXPVpdDzQvBL5Y 4aE3T7+QwRBdsNnSPti8XzmhqU6PdsKGLPGhhJr3BBlRYrbHniPvlAFUC/yWRZDo+FCY uQr8EJA/CCtFcqIoPcbl5hzLpfbUvfPJDOAS5GizfV/TzqO9aE3v1X0TYISqdPMZfaT0 Q3J+m6KnwciYi6hJyDj8bzvSngH2VD0Fp15tFUis0C8lSPll1hi1SzkH5GTU/+0oYqHS YRrSLUxw2niB7knH/cYBDcMzDuptHK2ujlG8Rgn3I6AdWVIe/aFpDtM6VSXH9m4/KHJk Zzvw== X-Gm-Message-State: AOAM530vqS2N67sImi8i0dBts6V7u+n+Mg4zylInlqF8+tkDKMBxla20 UQX5I5JHQ6hwCkccQL+1Lr4= X-Google-Smtp-Source: ABdhPJxn833jupaamj8VbrnQIBjwbA4RDar5lOpXhyo1jksXZHcHMwIbMN6fnlhc5y6g4fEutsDj8g== X-Received: by 2002:a2e:8144:: with SMTP id t4mr9937763ljg.412.1591018825203; Mon, 01 Jun 2020 06:40:25 -0700 (PDT) Received: from xi.terra (c-beaee455.07-184-6d6c6d4.bbcust.telenor.se. [85.228.174.190]) by smtp.gmail.com with ESMTPSA id 193sm2446783ljj.48.2020.06.01.06.40.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2020 06:40:23 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.93.0.4) (envelope-from ) id 1jfkfp-0003Fj-4a; Mon, 01 Jun 2020 15:40:17 +0200 From: Johan Hovold To: Jacek Anaszewski , Pavel Machek Cc: Dan Murphy , Amitoj Kaur Chawla , linux-leds@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable Subject: [PATCH 2/6] leds: da903x: fix use-after-free on unbind Date: Mon, 1 Jun 2020 15:39:46 +0200 Message-Id: <20200601133950.12420-3-johan@kernel.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200601133950.12420-1-johan@kernel.org> References: <20200601133950.12420-1-johan@kernel.org> MIME-Version: 1.0 Sender: linux-leds-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-leds@vger.kernel.org Several MFD child drivers register their class devices directly under the parent device. This means you cannot blindly do devres conversions so that deregistration ends up being tied to the parent device, something which leads to use-after-free on driver unbind when the class device is released while still being registered. Fixes: eed16255d66b ("leds: da903x: Use devm_led_classdev_register") Cc: stable # 4.6 Cc: Amitoj Kaur Chawla Signed-off-by: Johan Hovold --- drivers/leds/leds-da903x.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/leds/leds-da903x.c b/drivers/leds/leds-da903x.c index ed1b303f699f..2b5fb00438a2 100644 --- a/drivers/leds/leds-da903x.c +++ b/drivers/leds/leds-da903x.c @@ -110,12 +110,23 @@ static int da903x_led_probe(struct platform_device *pdev) led->flags = pdata->flags; led->master = pdev->dev.parent; - ret = devm_led_classdev_register(led->master, &led->cdev); + ret = led_classdev_register(led->master, &led->cdev); if (ret) { dev_err(&pdev->dev, "failed to register LED %d\n", id); return ret; } + platform_set_drvdata(pdev, led); + + return 0; +} + +static int da903x_led_remove(struct platform_device *pdev) +{ + struct da903x_led *led = platform_get_drvdata(pdev); + + led_classdev_unregister(&led->cdev); + return 0; } @@ -124,6 +135,7 @@ static struct platform_driver da903x_led_driver = { .name = "da903x-led", }, .probe = da903x_led_probe, + .remove = da903x_led_remove, }; module_platform_driver(da903x_led_driver);