spi: bitbang: Let spi_bitbang_start() take a reference to master

Many drivers that use bitbang library have a leak on probe error paths.
This is because once a spi_master_get() call succeeds, we need an additional
spi_master_put() call to free the memory.

Fix this issue by moving the code taking a reference to master to
spi_bitbang_start(), so spi_bitbang_start() will take a reference to master on
success. With this change, the caller is responsible for calling
spi_bitbang_stop() to decrement the reference and spi_master_put() as
counterpart of spi_alloc_master() to prevent a memory leak.

So now we have below patten for drivers using bitbang library:

probe:
spi_alloc_master        -> Init reference count to 1
spi_bitbang_start       -> Increment reference count
remove:
spi_bitbang_stop        -> Decrement reference count
spi_master_put          -> Decrement reference count (reference count reaches 0)

Fixup all users accordingly.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Suggested-by: Uwe Kleine-Koenig <u.kleine-koenig@pengutronix.de>
Acked-by: Uwe Kleine-Koenig <u.kleine-koenig@pengutronix.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Huang Shijie <b32955@freescale.com>

11 files changed, 25 insertions, 18 deletions

diff --git a/drivers/spi/spi-altera.c b/drivers/spi/spi-altera.c
index 8a6bb37910da..b5d5424fe2ad 100644
--- a/drivers/spi/spi-altera.c
+++ b/drivers/spi/spi-altera.c
@@ -226,7 +226,7 @@ static int altera_spi_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, hw);
 
         /* setup the state for the bitbang driver */
-        hw->bitbang.master = spi_master_get(master);
+        hw->bitbang.master = master;
         if (!hw->bitbang.master)
                 return err;
         hw->bitbang.chipselect = altera_spi_chipsel;
diff --git a/drivers/spi/spi-ath79.c b/drivers/spi/spi-ath79.c
index 0e06407a4670..649ad16260a3 100644
--- a/drivers/spi/spi-ath79.c
+++ b/drivers/spi/spi-ath79.c
@@ -231,7 +231,7 @@ static int ath79_spi_probe(struct platform_device *pdev)
                 master->num_chipselect = pdata->num_chipselect;
         }
 
-        sp->bitbang.master = spi_master_get(master);
+        sp->bitbang.master = master;
         sp->bitbang.chipselect = ath79_spi_chipselect;
         sp->bitbang.txrx_word[SPI_MODE_0] = ath79_spi_txrx_mode0;
         sp->bitbang.setup_transfer = spi_bitbang_setup_transfer;
diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c
index 8c11355dec23..0056623dfc6b 100644
--- a/drivers/spi/spi-bitbang.c
+++ b/drivers/spi/spi-bitbang.c
@@ -414,10 +414,16 @@ static int spi_bitbang_unprepare_hardware(struct spi_master *spi)
  * This routine registers the spi_master, which will process requests in a
  * dedicated task, keeping IRQs unblocked most of the time.  To stop
  * processing those requests, call spi_bitbang_stop().
+ *
+ * On success, this routine will take a reference to master. The caller is
+ * responsible for calling spi_bitbang_stop() to decrement the reference and
+ * spi_master_put() as counterpart of spi_alloc_master() to prevent a memory
+ * leak.
  */
 int spi_bitbang_start(struct spi_bitbang *bitbang)
 {
         struct spi_master *master = bitbang->master;
+        int ret;
 
         if (!master || !bitbang->chipselect)
                 return -EINVAL;
@@ -449,7 +455,11 @@ int spi_bitbang_start(struct spi_bitbang *bitbang)
         /* driver may get busy before register() returns, especially
          * if someone registered boardinfo for devices
          */
-        return spi_register_master(master);
+        ret = spi_register_master(spi_master_get(master));
+        if (ret)
+                spi_master_put(master);
+
+        return 0;
 }
 EXPORT_SYMBOL_GPL(spi_bitbang_start);
 
diff --git a/drivers/spi/spi-butterfly.c b/drivers/spi/spi-butterfly.c
index 5ed08e537433..b1ecea2d76b3 100644
--- a/drivers/spi/spi-butterfly.c
+++ b/drivers/spi/spi-butterfly.c
@@ -225,7 +225,7 @@ static void butterfly_attach(struct parport *p)
         master->bus_num = 42;
         master->num_chipselect = 2;
 
-        pp->bitbang.master = spi_master_get(master);
+        pp->bitbang.master = master;
         pp->bitbang.chipselect = butterfly_chipselect;
         pp->bitbang.txrx_word[SPI_MODE_0] = butterfly_txrx_word_mode0;
 
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index afb581e415b0..487691a8c577 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -916,7 +916,7 @@ static int davinci_spi_probe(struct platform_device *pdev)
         if (ret)
                 goto unmap_io;
 
-        dspi->bitbang.master = spi_master_get(master);
+        dspi->bitbang.master = master;
         if (dspi->bitbang.master == NULL) {
                 ret = -ENODEV;
                 goto irq_free;
@@ -925,7 +925,7 @@ static int davinci_spi_probe(struct platform_device *pdev)
         dspi->clk = clk_get(&pdev->dev, NULL);
         if (IS_ERR(dspi->clk)) {
                 ret = -ENODEV;
-                goto put_master;
+                goto irq_free;
         }
         clk_prepare_enable(dspi->clk);
 
@@ -1015,8 +1015,6 @@ free_dma:
 free_clk:
         clk_disable_unprepare(dspi->clk);
         clk_put(dspi->clk);
-put_master:
-        spi_master_put(master);
 irq_free:
         free_irq(dspi->irq, dspi);
 unmap_io:
@@ -1024,7 +1022,7 @@ unmap_io:
 release_region:
         release_mem_region(dspi->pbase, resource_size(r));
 free_master:
-        kfree(master);
+        spi_master_put(master);
 err:
         return ret;
 }
@@ -1051,11 +1049,11 @@ static int davinci_spi_remove(struct platform_device *pdev)
 
         clk_disable_unprepare(dspi->clk);
         clk_put(dspi->clk);
-        spi_master_put(master);
         free_irq(dspi->irq, dspi);
         iounmap(dspi->base);
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         release_mem_region(dspi->pbase, resource_size(r));
+        spi_master_put(master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
index a54524cf42cc..bc8078490240 100644
--- a/drivers/spi/spi-gpio.c
+++ b/drivers/spi/spi-gpio.c
@@ -467,7 +467,7 @@ static int spi_gpio_probe(struct platform_device *pdev)
         }
 #endif
 
-        spi_gpio->bitbang.master = spi_master_get(master);
+        spi_gpio->bitbang.master = master;
         spi_gpio->bitbang.chipselect = spi_gpio_chipselect;
 
         if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) {
@@ -486,7 +486,6 @@ static int spi_gpio_probe(struct platform_device *pdev)
 
         status = spi_bitbang_start(&spi_gpio->bitbang);
         if (status < 0) {
-                spi_master_put(spi_gpio->bitbang.master);
 gpio_free:
                 if (SPI_MISO_GPIO != SPI_GPIO_NO_MISO)
                         gpio_free(SPI_MISO_GPIO);
@@ -510,13 +509,13 @@ static int spi_gpio_remove(struct platform_device *pdev)
 
         /* stop() unregisters child devices too */
         status = spi_bitbang_stop(&spi_gpio->bitbang);
-        spi_master_put(spi_gpio->bitbang.master);
 
         if (SPI_MISO_GPIO != SPI_GPIO_NO_MISO)
                 gpio_free(SPI_MISO_GPIO);
         if (SPI_MOSI_GPIO != SPI_GPIO_NO_MOSI)
                 gpio_free(SPI_MOSI_GPIO);
         gpio_free(SPI_SCK_GPIO);
+        spi_master_put(spi_gpio->bitbang.master);
 
         return status;
 }
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 15323d8bd9cf..02d9f468b2b6 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -786,7 +786,7 @@ static int spi_imx_probe(struct platform_device *pdev)
         master->num_chipselect = num_cs;
 
         spi_imx = spi_master_get_devdata(master);
-        spi_imx->bitbang.master = spi_master_get(master);
+        spi_imx->bitbang.master = master;
 
         for (i = 0; i < master->num_chipselect; i++) {
                 int cs_gpio = of_get_named_gpio(np, "cs-gpios", i);
diff --git a/drivers/spi/spi-lm70llp.c b/drivers/spi/spi-lm70llp.c
index 0759b5db9883..41c5765be746 100644
--- a/drivers/spi/spi-lm70llp.c
+++ b/drivers/spi/spi-lm70llp.c
@@ -222,7 +222,7 @@ static void spi_lm70llp_attach(struct parport *p)
         /*
          * SPI and bitbang hookup.
          */
-        pp->bitbang.master = spi_master_get(master);
+        pp->bitbang.master = master;
         pp->bitbang.chipselect = lm70_chipselect;
         pp->bitbang.txrx_word[SPI_MODE_0] = lm70_txrx;
         pp->bitbang.flags = SPI_3WIRE;
diff --git a/drivers/spi/spi-oc-tiny.c b/drivers/spi/spi-oc-tiny.c
index 58deb79d046b..b092a022fce0 100644
--- a/drivers/spi/spi-oc-tiny.c
+++ b/drivers/spi/spi-oc-tiny.c
@@ -306,7 +306,7 @@ static int tiny_spi_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, hw);
 
         /* setup the state for the bitbang driver */
-        hw->bitbang.master = spi_master_get(master);
+        hw->bitbang.master = master;
         if (!hw->bitbang.master)
                 return err;
         hw->bitbang.setup_transfer = tiny_spi_setup_transfer;
diff --git a/drivers/spi/spi-sirf.c b/drivers/spi/spi-sirf.c
index 77497be042a8..8b45fd7b3c71 100644
--- a/drivers/spi/spi-sirf.c
+++ b/drivers/spi/spi-sirf.c
@@ -546,7 +546,7 @@ static int spi_sirfsoc_probe(struct platform_device *pdev)
         if (ret)
                 goto free_master;
 
-        sspi->bitbang.master = spi_master_get(master);
+        sspi->bitbang.master = master;
         sspi->bitbang.chipselect = spi_sirfsoc_chipselect;
         sspi->bitbang.setup_transfer = spi_sirfsoc_setup_transfer;
         sspi->bitbang.txrx_bufs = spi_sirfsoc_transfer;
diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
index c63837f36411..7a169350d4ee 100644
--- a/drivers/spi/spi-xilinx.c
+++ b/drivers/spi/spi-xilinx.c
@@ -354,7 +354,7 @@ struct spi_master *xilinx_spi_init(struct device *dev, struct resource *mem,
         master->mode_bits = SPI_CPOL | SPI_CPHA;
 
         xspi = spi_master_get_devdata(master);
-        xspi->bitbang.master = spi_master_get(master);
+        xspi->bitbang.master = master;
         xspi->bitbang.chipselect = xilinx_spi_chipselect;
         xspi->bitbang.setup_transfer = xilinx_spi_setup_transfer;
         xspi->bitbang.txrx_bufs = xilinx_spi_txrx_bufs;