[PATCH v2 0/2] mtd: fix use-after-free on unbind with open handles

[tze . yee . ng]

From: Tze Yee Ng <tze.yee.ng@xxxxxxxxxx>

An open /dev/mtdX can outlive driver unbind. The MTD core keeps
mtd_info registered until the last close, but a spi-nor allocated
with devm_*() on the SPI device is already freed, so a later
close/ioctl/read hits freed memory.

v1 tried to fix that with a spi-nor-local kref and nor->removed.
That duplicated mtd->refcnt and still missed get_device() after
unbind, suspend/resume, and eraseregions. v2 puts the lifetime in
the MTD core instead.

  - Patch 1: add optional mtd->_free() (called from kref release)
    and mtd->removed so the core returns -ENODEV for hw ops, new
    openers, and suspend/resume.
  - Patch 2: on the spi-mem path, allocate spi_nor / params /
    eraseregions / bouncebuf with kmalloc, install mtd->_free, and
    set mtd->removed in remove() after draining in-flight ops.
    Legacy controllers keep the old devres lifetime.

Changes in v2:
  - Drop the unrelated RWW self-deadlock fix.
  - New patch 1: MTD-core _free / removed hooks.
  - Patch 2: drop the spi-nor kref / refcounted / controller_module
    and the prep_and_lock*() removed checks; use the core hooks.
    Also keep eraseregions on that lifetime, free on the probe
    error path, and unregister debugfs from _free.

Tze Yee Ng (2):
  mtd: core: add release hook and removed flag for unbind with open
    handles
  mtd: spi-nor: fix use-after-free on unbind with open handles

 drivers/mtd/mtdcore.c         | 20 ++++++++
 drivers/mtd/spi-nor/core.c    | 92 +++++++++++++++++++++++++++++------
 drivers/mtd/spi-nor/core.h    |  2 +
 drivers/mtd/spi-nor/debugfs.c |  9 +---
 include/linux/mtd/mtd.h       | 13 +++++
 5 files changed, 112 insertions(+), 24 deletions(-)

-- 
2.43.7