The mixing managed and non-managed resources lay lead to all possible
use-after-free bugs. In this driver the problematic part is the configuration
space bits that may just gone behind the functions back, e.g., when interrupt
is being served. Fix this by switching to managed resources for PCI.

Fixes: 91a3e1f5453a ("mfd: ls2kbmc: Check for devm_mfd_add_devices() failure")
Fixes: d952bba3fbb5 ("mfd: ls2kbmc: Add Loongson-2K BMC reset function support")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/mfd/ls2k-bmc-core.c | 36 +++++++++---------------------------
 1 file changed, 9 insertions(+), 27 deletions(-)

diff --git a/drivers/mfd/ls2k-bmc-core.c b/drivers/mfd/ls2k-bmc-core.c
index 69387dad6661..616ff0a28b00 100644
--- a/drivers/mfd/ls2k-bmc-core.c
+++ b/drivers/mfd/ls2k-bmc-core.c
@@ -464,25 +464,23 @@ static int ls2k_bmc_probe(struct pci_dev *dev, const struct pci_device_id *id)
 	resource_size_t base;
 	int ret;
 
-	ret = pci_enable_device(dev);
+	ret = pcim_enable_device(dev);
 	if (ret)
 		return ret;
 
 	ddata = devm_kzalloc(&dev->dev, sizeof(*ddata), GFP_KERNEL);
-	if (!ddata) {
-		ret = -ENOMEM;
-		goto disable_pci;
-	}
+	if (!ddata)
+		return -ENOMEM;
 
 	ddata->dev = &dev->dev;
 
 	ret = ls2k_bmc_init(ddata);
 	if (ret)
-		goto disable_pci;
+		return ret;
 
 	ret = ls2k_bmc_parse_mode(dev, &pd);
 	if (ret)
-		goto disable_pci;
+		return ret;
 
 	ls2k_bmc_cells[LS2K_BMC_DISPLAY].platform_data = &pd;
 	ls2k_bmc_cells[LS2K_BMC_DISPLAY].pdata_size = sizeof(pd);
@@ -490,27 +488,12 @@ static int ls2k_bmc_probe(struct pci_dev *dev, const struct pci_device_id *id)
 
 	/* Remove conflicting efifb device */
 	ret = aperture_remove_conflicting_devices(base, SZ_4M, "simple-framebuffer");
-	if (ret) {
-		dev_err(&dev->dev, "Failed to removed firmware framebuffers: %d\n", ret);
-		goto disable_pci;
-	}
-
-	ret = devm_mfd_add_devices(&dev->dev, PLATFORM_DEVID_AUTO,
-				   ls2k_bmc_cells, ARRAY_SIZE(ls2k_bmc_cells),
-				   &dev->resource[0], 0, NULL);
 	if (ret)
-		goto disable_pci;
+		return dev_err_probe(&dev->dev, ret, "Failed to removed firmware framebuffers\n");
 
-	return 0;
-
-disable_pci:
-	pci_disable_device(dev);
-	return ret;
-}
-
-static void ls2k_bmc_remove(struct pci_dev *dev)
-{
-	pci_disable_device(dev);
+	return devm_mfd_add_devices(&dev->dev, PLATFORM_DEVID_AUTO,
+				    ls2k_bmc_cells, ARRAY_SIZE(ls2k_bmc_cells),
+				    &dev->resource[0], 0, NULL);
 }
 
 static struct pci_device_id ls2k_bmc_devices[] = {
@@ -523,7 +506,6 @@ static struct pci_driver ls2k_bmc_driver = {
 	.name = "ls2k-bmc",
 	.id_table = ls2k_bmc_devices,
 	.probe = ls2k_bmc_probe,
-	.remove = ls2k_bmc_remove,
 };
 module_pci_driver(ls2k_bmc_driver);
 
-- 
2.50.1

On Thu, 30 Oct 2025, Andy Shevchenko wrote:

> The mixing managed and non-managed resources lay lead to all possible

Nit: "The mixing of ... may lead"

"all" really?  Maybe drop that bit.

> use-after-free bugs. In this driver the problematic part is the configuration
> space bits that may just gone behind the functions back, e.g., when interrupt

"have gone", but is this the best way we can describe this?

> is being served. Fix this by switching to managed resources for PCI.
> 
> Fixes: 91a3e1f5453a ("mfd: ls2kbmc: Check for devm_mfd_add_devices() failure")
> Fixes: d952bba3fbb5 ("mfd: ls2kbmc: Add Loongson-2K BMC reset function support")
> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> ---
>  drivers/mfd/ls2k-bmc-core.c | 36 +++++++++---------------------------
>  1 file changed, 9 insertions(+), 27 deletions(-)
> 
> diff --git a/drivers/mfd/ls2k-bmc-core.c b/drivers/mfd/ls2k-bmc-core.c
> index 69387dad6661..616ff0a28b00 100644
> --- a/drivers/mfd/ls2k-bmc-core.c
> +++ b/drivers/mfd/ls2k-bmc-core.c
> @@ -464,25 +464,23 @@ static int ls2k_bmc_probe(struct pci_dev *dev, const struct pci_device_id *id)
>  	resource_size_t base;
>  	int ret;
>  
> -	ret = pci_enable_device(dev);
> +	ret = pcim_enable_device(dev);
>  	if (ret)
>  		return ret;
>  
>  	ddata = devm_kzalloc(&dev->dev, sizeof(*ddata), GFP_KERNEL);
> -	if (!ddata) {
> -		ret = -ENOMEM;
> -		goto disable_pci;
> -	}
> +	if (!ddata)
> +		return -ENOMEM;
>  
>  	ddata->dev = &dev->dev;
>  
>  	ret = ls2k_bmc_init(ddata);
>  	if (ret)
> -		goto disable_pci;
> +		return ret;
>  
>  	ret = ls2k_bmc_parse_mode(dev, &pd);
>  	if (ret)
> -		goto disable_pci;
> +		return ret;
>  
>  	ls2k_bmc_cells[LS2K_BMC_DISPLAY].platform_data = &pd;
>  	ls2k_bmc_cells[LS2K_BMC_DISPLAY].pdata_size = sizeof(pd);
> @@ -490,27 +488,12 @@ static int ls2k_bmc_probe(struct pci_dev *dev, const struct pci_device_id *id)
>  
>  	/* Remove conflicting efifb device */
>  	ret = aperture_remove_conflicting_devices(base, SZ_4M, "simple-framebuffer");
> -	if (ret) {
> -		dev_err(&dev->dev, "Failed to removed firmware framebuffers: %d\n", ret);
> -		goto disable_pci;
> -	}
> -
> -	ret = devm_mfd_add_devices(&dev->dev, PLATFORM_DEVID_AUTO,
> -				   ls2k_bmc_cells, ARRAY_SIZE(ls2k_bmc_cells),
> -				   &dev->resource[0], 0, NULL);
>  	if (ret)
> -		goto disable_pci;
> +		return dev_err_probe(&dev->dev, ret, "Failed to removed firmware framebuffers\n");

Nit: May as well fix "remove".

... since the patch set doesn't apply.  Please rebase onto MFD or -next.

-- 
Lee Jones [李琼斯]