[PATCH 04/28] mfd: ls2kbmc: Allocate simplefb platform_data on the heap

[Lee Jones]

ls2k_bmc_probe() declares struct simplefb_platform_data on the stack and
assigns its address to the display MFD cell.  Although mfd_add_device()
deep-copies platform_data via platform_device_add_data() before
ls2k_bmc_probe() returns, the shallow mfd_cell copy attached to the
child platform device retains a stale pointer to the expired stack
frame.

Allocate the simplefb_platform_data structure on the heap via
devm_kzalloc() prior to devm_mfd_add_devices() so the pointer remains
valid for the lifetime of the child platform device.

Closes: https://sashiko.dev/#/bug/linux-4e2dd9cb-310b-4bba-b305-ffacc738285c
Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---
 drivers/mfd/ls2k-bmc-core.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/mfd/ls2k-bmc-core.c b/drivers/mfd/ls2k-bmc-core.c
index e245bdee8226..3e3bc835262e 100644
--- a/drivers/mfd/ls2k-bmc-core.c
+++ b/drivers/mfd/ls2k-bmc-core.c
@@ -470,7 +470,7 @@ static int ls2k_bmc_parse_mode(struct pci_dev *pdev, struct simplefb_platform_da
 
 static int ls2k_bmc_probe(struct pci_dev *dev, const struct pci_device_id *id)
 {
-	struct simplefb_platform_data pd;
+	struct simplefb_platform_data *pd;
 	struct ls2k_bmc_ddata *ddata;
 	resource_size_t base;
 	int ret;
@@ -489,12 +489,16 @@ static int ls2k_bmc_probe(struct pci_dev *dev, const struct pci_device_id *id)
 	if (ret)
 		return ret;
 
-	ret = ls2k_bmc_parse_mode(dev, &pd);
+	pd = devm_kzalloc(&dev->dev, sizeof(*pd), GFP_KERNEL);
+	if (!pd)
+		return -ENOMEM;
+
+	ret = ls2k_bmc_parse_mode(dev, pd);
 	if (ret)
 		return ret;
 
-	ls2k_bmc_cells[LS2K_BMC_DISPLAY].platform_data = &pd;
-	ls2k_bmc_cells[LS2K_BMC_DISPLAY].pdata_size = sizeof(pd);
+	ls2k_bmc_cells[LS2K_BMC_DISPLAY].platform_data = pd;
+	ls2k_bmc_cells[LS2K_BMC_DISPLAY].pdata_size = sizeof(*pd);
 	base = pci_resource_start(dev, 0) + LS2K_DISPLAY_RES_START;
 
 	/* Remove conflicting efifb device */
-- 
2.56.0.218.g1ec904b173-goog