spi: fix statistics allocation

commit dee0774bbb2abb172e9069ce5ffef579b12b3ae9 upstream.

The controller per-cpu statistics is not allocated until after the
controller has been registered with driver core, which leaves a window
where accessing the sysfs attributes can trigger a NULL-pointer
dereference.

Fix this by moving the statistics allocation to controller allocation
while tying its lifetime to that of the controller (rather than using
implicit devres).

Fixes: 6598b91b5ac3 ("spi: spi.c: Convert statistics to per-cpu u64_stats_t")
Cc: stable@vger.kernel.org	# 6.0
Cc: David Jander <david@protonic.nl>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260312151817.32100-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index babf5dfb2fc4caef537867823946d2ead0746686..7cf37e28e4859d42c95c15aa5bc95167ca167881 100644 (file)
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2940,6 +2940,8 @@ static void spi_controller_release(struct device *dev)
        struct spi_controller *ctlr;
 
        ctlr = container_of(dev, struct spi_controller, dev);
+
+       free_percpu(ctlr->pcpu_statistics);
        kfree(ctlr);
 }
 
@@ -3080,6 +3082,12 @@ struct spi_controller *__spi_alloc_controller(struct device *dev,
        if (!ctlr)
                return NULL;
 
+       ctlr->pcpu_statistics = spi_alloc_pcpu_stats(NULL);
+       if (!ctlr->pcpu_statistics) {
+               kfree(ctlr);
+               return NULL;
+       }
+
        device_initialize(&ctlr->dev);
        INIT_LIST_HEAD(&ctlr->queue);
        spin_lock_init(&ctlr->queue_lock);
@@ -3370,13 +3378,6 @@ int spi_register_controller(struct spi_controller *ctlr)
                if (status)
                        goto del_ctrl;
        }
-       /* Add statistics */
-       ctlr->pcpu_statistics = spi_alloc_pcpu_stats(dev);
-       if (!ctlr->pcpu_statistics) {
-               dev_err(dev, "Error allocating per-cpu statistics\n");
-               status = -ENOMEM;
-               goto destroy_queue;
-       }
 
        mutex_lock(&board_lock);
        list_add_tail(&ctlr->list, &spi_controller_list);
@@ -3389,8 +3390,6 @@ int spi_register_controller(struct spi_controller *ctlr)
        acpi_register_spi_devices(ctlr);
        return status;
 
-destroy_queue:
-       spi_destroy_queue(ctlr);
 del_ctrl:
        device_del(&ctlr->dev);
 free_bus_id: