106 lines
3.4 KiB
Diff
106 lines
3.4 KiB
Diff
From a30685e70936de07484b543dd506ba78e2dda7e9 Mon Sep 17 00:00:00 2001
|
|
From: Xiang Chen <chenxiang66@hisilicon.com>
|
|
Date: Sat, 22 May 2021 11:53:14 +0000
|
|
Subject: [PATCH 12/39] mtd: spi-nor: core: Fix an issue of releasing resources
|
|
during read/write
|
|
|
|
mainline inclusion
|
|
from mainline-v5.13-rc1
|
|
commit be94215be1ab19e5d38f50962f611c88d4bfc83a
|
|
category: bugfix
|
|
bugzilla: https://gitee.com/openeuler/kernel/issues/I8CSBP
|
|
CVE: NA
|
|
|
|
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=be94215be1ab19e5d38f50962f611c88d4bfc83a
|
|
|
|
----------------------------------------------------------------------------
|
|
|
|
commit be94215be1ab19e5d38f50962f611c88d4bfc83a upstream.
|
|
|
|
If rmmod the driver during read or write, the driver will release the
|
|
resources which are used during read or write, so it is possible to
|
|
refer to NULL pointer.
|
|
|
|
Use the testcase "mtd_debug read /dev/mtd0 0xc00000 0x400000 dest_file &
|
|
sleep 0.5;rmmod spi_hisi_sfc_v3xx.ko", the issue can be reproduced in
|
|
hisi_sfc_v3xx driver.
|
|
|
|
To avoid the issue, fill the interface _get_device and _put_device of
|
|
mtd_info to grab the reference to the spi controller driver module, so
|
|
the request of rmmod the driver is rejected before read/write is finished.
|
|
|
|
Fixes: b199489d37b2 ("mtd: spi-nor: add the framework for SPI NOR")
|
|
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
|
|
Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
|
|
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
|
|
Tested-by: Michael Walle <michael@walle.cc>
|
|
Tested-by: Tudor Ambarus <tudor.ambarus@microchip.com>
|
|
Reviewed-by: Michael Walle <michael@walle.cc>
|
|
Cc: stable@vger.kernel.org
|
|
Link: https://lore.kernel.org/r/1617262486-4223-1-git-send-email-yangyicong@hisilicon.com
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Signed-off-by: Chen Jun <chenjun102@huawei.com>
|
|
Acked-by: Weilong Chen <chenweilong@huawei.com>
|
|
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>
|
|
Signed-off-by: YunYi Yang <yangyunyi2@huawei.com>
|
|
|
|
Conflicts:
|
|
drivers/mtd/spi-nor/core.c
|
|
---
|
|
drivers/mtd/spi-nor/spi-nor.c | 32 ++++++++++++++++++++++++++++++++
|
|
1 file changed, 32 insertions(+)
|
|
|
|
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
|
|
index f1e92f63cab6..9792b776cc4c 100644
|
|
--- a/drivers/mtd/spi-nor/spi-nor.c
|
|
+++ b/drivers/mtd/spi-nor/spi-nor.c
|
|
@@ -3190,6 +3190,36 @@ static void spi_nor_resume(struct mtd_info *mtd)
|
|
dev_err(dev, "resume() failed\n");
|
|
}
|
|
|
|
+static int spi_nor_get_device(struct mtd_info *mtd)
|
|
+{
|
|
+ struct spi_nor *nor = mtd_to_spi_nor(mtd);
|
|
+ struct device *dev;
|
|
+
|
|
+ if (nor->spimem)
|
|
+ dev = nor->spimem->spi->controller->dev.parent;
|
|
+ else
|
|
+ dev = nor->dev;
|
|
+
|
|
+ if (!try_module_get(dev->driver->owner))
|
|
+ return -ENODEV;
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+static void spi_nor_put_device(struct mtd_info *mtd)
|
|
+{
|
|
+ struct spi_nor *nor = mtd_to_spi_nor(mtd);
|
|
+ struct device *dev;
|
|
+
|
|
+ if (nor->spimem)
|
|
+ dev = nor->spimem->spi->controller->dev.parent;
|
|
+ else
|
|
+ dev = nor->dev;
|
|
+
|
|
+ module_put(dev->driver->owner);
|
|
+}
|
|
+
|
|
+
|
|
void spi_nor_restore(struct spi_nor *nor)
|
|
{
|
|
/* restore the addressing mode */
|
|
@@ -3292,6 +3322,8 @@ int spi_nor_scan(struct spi_nor *nor, const char *name,
|
|
mtd->_erase = spi_nor_erase;
|
|
mtd->_read = spi_nor_read;
|
|
mtd->_resume = spi_nor_resume;
|
|
+ mtd->_get_device = spi_nor_get_device;
|
|
+ mtd->_put_device = spi_nor_put_device;
|
|
|
|
/* NOR protection support for STmicro/Micron chips and similar */
|
|
if (JEDEC_MFR(info) == SNOR_MFR_MICRON ||
|
|
--
|
|
2.27.0
|
|
|