Re: [PATCH] spi: fix use-after-free on managed registration failure

[Andy Shevchenko]

On Thu, Mar 26, 2026 at 11:35:56AM +0200, Andy Shevchenko wrote:
> On Wed, Mar 25, 2026 at 03:53:19PM +0100, Johan Hovold wrote:
> > The SPI API is asymmetric and the controller is freed as part of
> > deregistration (unless it has been allocated using
> > devm_spi_alloc_host/target()).
> > 
> > A recent change converting the managed registration function to use
> > devm_add_action_or_reset() inadvertently introduced a (mostly
> > theoretical) regression where a non-devres managed controller could be
> > freed as part of failed registration. This in turn would lead to
> > use-after-free in controller driver error paths.
> > 
> > Fix this by taking another reference before calling
> > devm_add_action_or_reset() and not releasing it on errors for
> > non-devres allocated controllers.
> > 
> > An alternative would be a partial revert of the offending commit, but
> > it is better to handle this explicitly until the API has been fixed
> > (e.g. see 5e844cc37a5c ("spi: Introduce device-managed SPI controller
> > allocation")).
> 
> Thank you!
> This is good TODO list now.
> 
> Acked-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>

Seems Mark dropped the original change, so this is not needed.

-- 
With Best Regards,
Andy Shevchenko