[PATCH 22/28] mfd: abx500-core: Unregister device ops on devm release

[Lee Jones]

abx500_register_ops() allocates struct abx500_device_entry via
devm_kzalloc() and links it into the global abx500_list without
registering a devres cleanup action.  If a caller's probe function
subsequently fails, devres frees the entry while it remains linked in
abx500_list, causing use-after-free and list corruption on later
traversals.

Register a devm_add_action_or_reset() callback in abx500_register_ops()
to remove the entry from abx500_list before devres frees it.

Fixes: c211b6b9c014 ("mfd: abx500-core: Convert to managed resources for allocating memory")
Closes: https://sashiko.dev/#/bug/linux-6a9c6b8b-8f89-4af5-8cb1-102822e44e6e
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---
 drivers/mfd/abx500-core.c | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/drivers/mfd/abx500-core.c b/drivers/mfd/abx500-core.c
index e896531d0354..5873e335c395 100644
--- a/drivers/mfd/abx500-core.c
+++ b/drivers/mfd/abx500-core.c
@@ -5,6 +5,7 @@
  * Author: Mattias Wallin <mattias.wallin@xxxxxxxxxxxxxx>
  */
 
+#include <linux/device.h>
 #include <linux/list.h>
 #include <linux/slab.h>
 #include <linux/err.h>
@@ -33,6 +34,21 @@ static void lookup_ops(struct device *dev, struct abx500_ops **ops)
 	}
 }
 
+void abx500_remove_ops(struct device *dev)
+{
+	struct abx500_device_entry *dev_entry, *tmp;
+
+	list_for_each_entry_safe(dev_entry, tmp, &abx500_list, list)
+		if (dev_entry->dev == dev)
+			list_del(&dev_entry->list);
+}
+EXPORT_SYMBOL(abx500_remove_ops);
+
+static void abx500_unregister_ops(void *data)
+{
+	abx500_remove_ops(data);
+}
+
 int abx500_register_ops(struct device *dev, struct abx500_ops *ops)
 {
 	struct abx500_device_entry *dev_entry;
@@ -45,20 +61,11 @@ int abx500_register_ops(struct device *dev, struct abx500_ops *ops)
 	memcpy(&dev_entry->ops, ops, sizeof(*ops));
 
 	list_add_tail(&dev_entry->list, &abx500_list);
-	return 0;
+
+	return devm_add_action_or_reset(dev, abx500_unregister_ops, dev);
 }
 EXPORT_SYMBOL(abx500_register_ops);
 
-void abx500_remove_ops(struct device *dev)
-{
-	struct abx500_device_entry *dev_entry, *tmp;
-
-	list_for_each_entry_safe(dev_entry, tmp, &abx500_list, list)
-		if (dev_entry->dev == dev)
-			list_del(&dev_entry->list);
-}
-EXPORT_SYMBOL(abx500_remove_ops);
-
 int abx500_set_register_interruptible(struct device *dev, u8 bank, u8 reg,
 	u8 value)
 {
-- 
2.56.0.218.g1ec904b173-goog