From: Patrice Chotard <patrice.chotard@foss.st.com>

Some device driver need to communicate to qspi device during the remove
process, qspi controller must be functional when spi_unregister_master()
is called.

To ensure this, replace devm_spi_register_master() by spi_register_master()
and spi_unregister_master() is called directly in .remove callback before
stopping the qspi controller.

This issue was put in evidence using kernel v5.11 and later
with a spi-nor which supports the software reset feature introduced
by commit d73ee7534cc5 ("mtd: spi-nor: core: perform a Soft Reset on
shutdown")

Fixes: c530cd1d9d5e ("spi: spi-mem: add stm32 qspi controller")

Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com>
Cc: <stable@vger.kernel.org> # 5.8.x
---

v2: 
  _ update commit message
  _ make usage of devm_spi_alloc_master() instead of spi_alloc_master()

 drivers/spi/spi-stm32-qspi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-stm32-qspi.c b/drivers/spi/spi-stm32-qspi.c
index 514337c86d2c..09839a3dbb26 100644
--- a/drivers/spi/spi-stm32-qspi.c
+++ b/drivers/spi/spi-stm32-qspi.c
@@ -688,7 +688,7 @@ static int stm32_qspi_probe(struct platform_device *pdev)
 	struct resource *res;
 	int ret, irq;
 
-	ctrl = spi_alloc_master(dev, sizeof(*qspi));
+	ctrl = devm_spi_alloc_master(dev, sizeof(*qspi));
 	if (!ctrl)
 		return -ENOMEM;
 
@@ -784,7 +784,7 @@ static int stm32_qspi_probe(struct platform_device *pdev)
 	pm_runtime_enable(dev);
 	pm_runtime_get_noresume(dev);
 
-	ret = devm_spi_register_master(dev, ctrl);
+	ret = spi_register_master(ctrl);
 	if (ret)
 		goto err_pm_runtime_free;
 
@@ -817,6 +817,7 @@ static int stm32_qspi_remove(struct platform_device *pdev)
 	struct stm32_qspi *qspi = platform_get_drvdata(pdev);
 
 	pm_runtime_get_sync(qspi->dev);
+	spi_unregister_master(qspi->ctrl);
 	/* disable qspi */
 	writel_relaxed(0, qspi->io_base + QSPI_CR);
 	stm32_qspi_dma_free(qspi);
-- 
2.17.1

On Wed, Jan 12, 2022 at 03:44:24PM +0100, patrice.chotard@foss.st.com wrote:
> diff --git a/drivers/spi/spi-stm32-qspi.c b/drivers/spi/spi-stm32-qspi.c
> index 514337c86d2c..09839a3dbb26 100644
> --- a/drivers/spi/spi-stm32-qspi.c
> +++ b/drivers/spi/spi-stm32-qspi.c
> @@ -688,7 +688,7 @@ static int stm32_qspi_probe(struct platform_device *pdev)
>  	struct resource *res;
>  	int ret, irq;
>  
> -	ctrl = spi_alloc_master(dev, sizeof(*qspi));
> +	ctrl = devm_spi_alloc_master(dev, sizeof(*qspi));
>  	if (!ctrl)
>  		return -ENOMEM;
>  
> @@ -784,7 +784,7 @@ static int stm32_qspi_probe(struct platform_device *pdev)
>  	pm_runtime_enable(dev);
>  	pm_runtime_get_noresume(dev);
>  
> -	ret = devm_spi_register_master(dev, ctrl);
> +	ret = spi_register_master(ctrl);
>  	if (ret)
>  		goto err_pm_runtime_free;
>

Unfortunately this patch is still not correct:  It introduces a
double free in the probe error path.

You need to remove this...

err_master_put:
	spi_master_put(qspi->ctrl);

...and replace all the gotos in stm32_qspi_probe() which jump
to the err_master_put label with a return statement.

Thanks,

Lukas

Hi Lukas

On 1/16/22 1:52 PM, Lukas Wunner wrote:
> On Wed, Jan 12, 2022 at 03:44:24PM +0100, patrice.chotard@foss.st.com wrote:
>> diff --git a/drivers/spi/spi-stm32-qspi.c b/drivers/spi/spi-stm32-qspi.c
>> index 514337c86d2c..09839a3dbb26 100644
>> --- a/drivers/spi/spi-stm32-qspi.c
>> +++ b/drivers/spi/spi-stm32-qspi.c
>> @@ -688,7 +688,7 @@ static int stm32_qspi_probe(struct platform_device *pdev)
>>  	struct resource *res;
>>  	int ret, irq;
>>  
>> -	ctrl = spi_alloc_master(dev, sizeof(*qspi));
>> +	ctrl = devm_spi_alloc_master(dev, sizeof(*qspi));
>>  	if (!ctrl)
>>  		return -ENOMEM;
>>  
>> @@ -784,7 +784,7 @@ static int stm32_qspi_probe(struct platform_device *pdev)
>>  	pm_runtime_enable(dev);
>>  	pm_runtime_get_noresume(dev);
>>  
>> -	ret = devm_spi_register_master(dev, ctrl);
>> +	ret = spi_register_master(ctrl);
>>  	if (ret)
>>  		goto err_pm_runtime_free;
>>
> 
> Unfortunately this patch is still not correct:  It introduces a
> double free in the probe error path.

Argh yes, my bad.

> 
> You need to remove this...
> 
> err_master_put:
> 	spi_master_put(qspi->ctrl);
> 
> ...and replace all the gotos in stm32_qspi_probe() which jump
> to the err_master_put label with a return statement.
> 
> Thanks,
> 
> Lukas
> 
Thanks 
Patrice