5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alexander Usyskin [ Upstream commit 79c4a56250216991f1d965ee26dcd273376e4e91 ] MTD provider provides mtd_info object to mtd subsystem. With kref patch the mtd_info object can be alive after provider released mtd device. Fix calling order in _get and _put functions to allow mtd provider to safely alloc and release mtd object. Execute: 1) call external _get 2) get_module 3) add internal kref in the get function and opposite order in the put one. The _put_device callback should be the last in put as the master struct memory may be freed in this callback. Signed-off-by: Alexander Usyskin Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230620131905.648089-3-alexander.usyskin@intel.com Stable-dep-of: 12b31d1acd20 ("mtd: core: call _get_device() with the master MTD") Signed-off-by: Sasha Levin --- drivers/mtd/mtdcore.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c index 2891150478133..5333d24b8c972 100644 --- a/drivers/mtd/mtdcore.c +++ b/drivers/mtd/mtdcore.c @@ -1157,21 +1157,20 @@ int __get_mtd_device(struct mtd_info *mtd) struct mtd_info *master = mtd_get_master(mtd); int err; - if (!try_module_get(master->owner)) - return -ENODEV; - - kref_get(&mtd->refcnt); - if (master->_get_device) { err = master->_get_device(mtd); - - if (err) { - kref_put(&mtd->refcnt, mtd_device_release); - module_put(master->owner); + if (err) return err; - } } + if (!try_module_get(master->owner)) { + if (master->_put_device) + master->_put_device(master); + return -ENODEV; + } + + kref_get(&mtd->refcnt); + while (mtd->parent) { if (IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER) || mtd->parent != master) kref_get(&mtd->parent->refcnt); @@ -1240,13 +1239,14 @@ void __put_mtd_device(struct mtd_info *mtd) mtd = parent; } - if (master->_put_device) - master->_put_device(master); + if (IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER)) + kref_put(&master->refcnt, mtd_device_release); module_put(master->owner); - if (IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER)) - kref_put(&master->refcnt, mtd_device_release); + /* must be the last as master can be freed in the _put_device */ + if (master->_put_device) + master->_put_device(master); } EXPORT_SYMBOL_GPL(__put_mtd_device); -- 2.53.0