spi: fix use-after-free on controller registration failure

Make sure to deregister from driver core also in the unlikely event that
per-cpu statistics allocation fails during controller registration to
avoid use-after-free (of driver resources) and unclocked register
accesses.

Fixes: 6598b91b5ac3 ("spi: spi.c: Convert statistics to per-cpu u64_stats_t")
Cc: stable@vger.kernel.org	# 6.0
Cc: David Jander <david@protonic.nl>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260312151817.32100-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 61f7bde8c7fbbccad315be98f4f6b863fc1e385b..9b2e307dc30a5e4846636c6af90d3a2245bd2d3c 100644 (file)
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -3480,10 +3480,8 @@ int spi_register_controller(struct spi_controller *ctlr)
                dev_info(dev, "controller is unqueued, this is deprecated\n");
        } else if (ctlr->transfer_one || ctlr->transfer_one_message) {
                status = spi_controller_initialize_queue(ctlr);
-               if (status) {
-                       device_del(&ctlr->dev);
-                       goto free_bus_id;
-               }
+               if (status)
+                       goto del_ctrl;
        }
        /* Add statistics */
        ctlr->pcpu_statistics = spi_alloc_pcpu_stats(dev);
@@ -3506,6 +3504,8 @@ int spi_register_controller(struct spi_controller *ctlr)
 
 destroy_queue:
        spi_destroy_queue(ctlr);
+del_ctrl:
+       device_del(&ctlr->dev);
 free_bus_id:
        mutex_lock(&board_lock);
        idr_remove(&spi_controller_idr, ctlr->bus_num);