spi sprd-adi Controller Double-Free

Vulnerability analysis

Root Cause: The driver uses spi_alloc_host() to allocate an SPI controller but registers it with devm_spi_register_controller(). In the probe error path, when devm_register_restart_handler() fails, the code manually calls spi_controller_put(). However, since the controller was registered using a devm function, the device core automatically calls spi_controller_put() again during probe cleanup, resulting in a double-free of the spi_controller structure.

Attack Surface: Local attack surface requiring physical access to the device or ability to trigger SPI driver probe failures. The vulnerability occurs during device initialization when the restart handler registration fails, making it dependent on specific hardware configurations and timing conditions.

Fix Mechanism: The patch switches from spi_alloc_host() to devm_spi_alloc_host() for controller allocation and removes all manual spi_controller_put() calls. This ensures consistent device-managed resource handling where the device core automatically handles cleanup without manual intervention, eliminating the double-free condition.