[PATCH v3 0/2] mtd: spi-nor: fix use-after-free on unbind with open handles

[tze.yee.ng at altera.com]

From: Tze Yee Ng <tze.yee.ng at altera.com>

An open /dev/mtdX can outlive driver unbind. The MTD core keeps mtd_info
registered until the last close, but a spi_nor allocated with devm_*() on
the SPI device is already freed, so a later close, ioctl, read or
mtdblock flush uses freed memory.

v2 moved the lifetime into the MTD core (mtd->_free and mtd->removed).
Review pointed out that this creates new problems in the core: the master
can be freed inside __put_mtd_device() while it is still used, the driver
object leaks when CONFIG_MTD_PARTITIONED_MASTER is off, and a lockless
removed check races with remove(). Only spi-nor needs the fix, so v3
goes back to a spi-nor-local kref and reduces the core change to one
reorder:
  - Patch 1: in __put_mtd_device(), call ->_put_device() first and drop the
    module reference last, so the owner module stays pinned while
    ->_put_device() frees the driver object.
  - Patch 2: on the spi-mem path, allocate spi_nor, params, erase regions
    and the bounce buffer with kmalloc and refcount spi_nor (one
    reference for registration plus one per open handle). remove()
    unregisters debugfs and the MTD device, then sets nor->removed under
    the nor lock; prep_and_lock*() re-check it under the lock and return
    -ENODEV. Legacy controllers keep the devres lifetime.

Not covered:
  - A sysfs file held open across unbind is a core lifetime question for
    all MTD drivers and is left out of this series.

---
Changes in v3:
  - Drop the core _free/removed hooks. Patch 1 is only the module_put()
    reorder.
  - Patch 2: spi-nor kref again, removed re-checked under the lock,
    controller module cached at probe, debugfs and MTD unregistered at the
    start of remove() so mtdblock can flush, eraseregions leak and probe
    error paths fixed.

Changes in v2:
  - Drop the unrelated RWW self-deadlock fix.
  - New patch 1: MTD-core _free / removed hooks.
  - Patch 2: drop the spi-nor kref / refcounted / controller_module
    and the prep_and_lock*() removed checks; use the core hooks.
    Also keep eraseregions on that lifetime, free on the probe
    error path, and unregister debugfs from _free.

v2: https://lore.kernel.org/all/cover.1791512623.git.tze.yee.ng@altera.com/

Tze Yee Ng (2):
  mtd: core: drop the module reference after ->_put_device()
  mtd: spi-nor: fix use-after-free on unbind with open handles

 drivers/mtd/mtdcore.c         |   9 +-
 drivers/mtd/spi-nor/core.c    | 173 +++++++++++++++++++++++++++-------
 drivers/mtd/spi-nor/core.h    |   2 +
 drivers/mtd/spi-nor/debugfs.c |   9 +-
 include/linux/mtd/spi-nor.h   |   9 ++
 5 files changed, 159 insertions(+), 43 deletions(-)

-- 
2.43.7