From nobody Mon Feb 9 08:12:10 2026 Received: from mail-oa1-f46.google.com (mail-oa1-f46.google.com [209.85.160.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 257C836164B for ; Fri, 16 Jan 2026 10:41:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768560120; cv=none; b=m8JmOTZIGSbfnjVlpSUq1q4SxA9fQ4pNRjZfVUW3wt4J7DQ8U9cik3FB/6UKc19ebTEkO+9WT5CwwWm5wTPSEn93LMJ60/p0ZLPMigPYw8kqOMA6mLa6b/t6A10HX9p0yj/9UrFFHwCjhmljNDLTkCb3NTuZSI5hIADGpPFB14w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768560120; c=relaxed/simple; bh=khagCyvCtlkZkLZ6tMgMbBbh4jk4K8LYJ0uHpPx08zA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ZCFAHJWZtvxEJVy9lBbghW82pOVJmelwfkQrsK6+ryVL7Z1bWnWFx7PZ/sqRBP6HnQ4C3rBZ6EmnuvOH9ayYRmW2NrBkC8zVI3Dx/qaxTuCxYvhXh1TpMCy1iFcVqSnUatvsULanlRm6F3m+x3NyNn0fG+r/Eo8o4keq/c9Yw7g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.160.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-oa1-f46.google.com with SMTP id 586e51a60fabf-40438380b88so1050705fac.3 for ; Fri, 16 Jan 2026 02:41:57 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768560117; x=1769164917; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=kWP/17hgPXs1aPCeyH6zzzFq2BcuhKEIrKVBaeDul+c=; b=L7Mr3OyMVsRbSxezKPG+MTMr/9JQY81uBUxrLHSWtcNEsjCGR9D2jd5hcqXjOjcQVy IIX7z1jkkdv6OUXX/LrZEDWrD2bdD2UPOjxdhvdcNEuTcZ9cJ10R3PEYTfT0rURroUcF OOxnEJDNjWzsR5TwDv/qP7xWE4n0G47kuz/o0jXaJso8mxGufrwv8pgOMFbOsjxb/ZEy FVk2BNFmlMtb7YMZ6yGjNltucUyryMREMlsGk1nghGv1MelFSwQOoeRM+NpeSjZhJJd0 hliHa4ZRq+Dq7okWluyT44vIqHEzGT9kbg+uiK+ypaND2TiKfS/cArpqbu/rb4JxYho1 4jyQ== X-Forwarded-Encrypted: i=1; AJvYcCU+FPcBqr0z4PLXwGlLEtRU5/7VpI+BdCI46SEonBFdIPqlwJI2ACkV64Z3CkBOCALqvx1OX+RvmWopZOA=@vger.kernel.org X-Gm-Message-State: AOJu0YwPYidAXY6+MVSETIkmKXfUzbMLO/7M+a+GBaO0Xb2DN5JinjY0 w1vGdCquF5dRrPVPw44AgPihFDmCu78XHjR5pdSrOcuWw5JZ7wpKIdO6 X-Gm-Gg: AY/fxX4s82ajp7WUE+xcz6RmG4E25t7CfqsWbxJfGQhCrodzELTuungLFYoUYJwnjr/ YMjY84EYCPnmQ7RnB65utlKCLCIy39TSiFUmUKNPMQFdOlCqjv72HzMo3HJ0R81o7TR7+n0yBhU WiZ4SiyzEWczbUcQcmw+NGGlC9EW8mvCNQbKAFfg2CzP8BhV/mQ30sfV2RIC2KXdcgb2sfTMG9H 64dog52GTLOQmll/1WF9iBI35Vr3Rre0FpbiumtRUId9O35LcDfhwXJf0efhXyqM7Te0yN5Wtry HF+9b44mh17zhpk+/+lebfbbatPdFmF2j7cvtXXipQC2EFh1vxxPFTm74ndmTcS5lWXMmrp05HG JmEDDxQwHQnYz9JUSi3WkL34Lg0D6vW2RE8rZA2CETCEj1auUTIAOhiShZDIr6d1BfwTSL3W8yQ gOQA== X-Received: by 2002:a05:6871:7813:b0:3ec:495a:74f2 with SMTP id 586e51a60fabf-4044c1646d7mr1294805fac.3.1768560117088; Fri, 16 Jan 2026 02:41:57 -0800 (PST) Received: from localhost ([2a03:2880:10ff:74::]) by smtp.gmail.com with ESMTPSA id 586e51a60fabf-4044baf5402sm1498837fac.4.2026.01.16.02.41.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Jan 2026 02:41:56 -0800 (PST) From: Breno Leitao Date: Fri, 16 Jan 2026 02:41:41 -0800 Subject: [PATCH 1/6] spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260116-tegra_xfer-v1-1-02d96c790619@debian.org> References: <20260116-tegra_xfer-v1-0-02d96c790619@debian.org> In-Reply-To: <20260116-tegra_xfer-v1-0-02d96c790619@debian.org> To: Thierry Reding , Jonathan Hunter , Sowjanya Komatineni , Laxman Dewangan , Mark Brown , Vishwaroop A Cc: Thierry Reding , linux-tegra@vger.kernel.org, linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Breno Leitao , kernel-team@meta.com, puranjay@kernel.org, usamaarif642@gmail.com X-Mailer: b4 0.15-dev-47773 X-Developer-Signature: v=1; a=openpgp-sha256; l=2295; i=leitao@debian.org; h=from:subject:message-id; bh=khagCyvCtlkZkLZ6tMgMbBbh4jk4K8LYJ0uHpPx08zA=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBpahXyAb/i58UaGRiL76BUEpdcuRkwVBGWYlv+W lA7tLbrr6uJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCaWoV8gAKCRA1o5Of/Hh3 bQofEACn9qUAZwrQbBKzcIOJAksw0DvoG4SxaSBDlerjG0lmRbJQSoQPYp2dMSizxEBY2shLfxm pNp4M6LxXS4zcdnty36YkkL8Jh14lwjAQ2xgi7TtQQ/SjpnSaiR8cllpfIYstfsXQwXfJYy15sQ ueGr+Roc8VzOCXPpfZT35HmBzzbmJTvAqcXcN25p/l/NkxTFTFtkVryEkX16w2ga2CRZwzgduhW Zbunji5OdwIprunh/dtmgFa0iGhgUGhR0/5+m96RuzNmwPAyzOOAaN608h4mqRYRht/IUl2gBJZ 75nX6BecBJ+JACOnkptjhcr4pa3qdMXeQhAuXJu7VAAJG2hZY8d0w8I9lvlE64gAjVMkevYG/DH wPa8XmYchMxGkeeI/3aAMm/AYbwxsxf1YJrP0Gc2EeuAF7Lxq4xsL6UnYqbgkGJ/xyrekc/TjW2 DDP1g2PWWtiBS02Ub4KjGvYX1AdT5FMFlkNwvT4bRT8L3oHDuaMsin9bPXkK17z0Q+FIUT02e5B SgFzNsW9+CQUNkLDpt5MEbwAwK9xqBDkf/pmgjl9Tc6eQyk/xqPoY8ZGFZypvzMHij+iH2TGWGq OqDj+MJGbpKFrXkNsGHjxl04qhIY/EG7pNEPnT7igiFygbbQY1gziazmd0PMtZkvuBatarJUGu1 5LxcHUZpR+D0VEg== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D When the ISR thread wakes up late and finds that the timeout handler has already processed the transfer (curr_xfer is NULL), return IRQ_HANDLED instead of IRQ_NONE. Use a similar approach to tegra_qspi_handle_timeout() by reading QSPI_TRANS_STATUS and checking the QSPI_RDY bit to determine if the hardware actually completed the transfer. If QSPI_RDY is set, the interrupt was legitimate and triggered by real hardware activity. The fact that the timeout path handled it first doesn't make it spurious. Returning IRQ_NONE incorrectly suggests the interrupt wasn't for this device, which can cause issues with shared interrupt lines and interrupt accounting. Fixes: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling") Signed-off-by: Breno Leitao --- drivers/spi/spi-tegra210-quad.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-qua= d.c index cdc3cb7c01f9..f0408c0b4b98 100644 --- a/drivers/spi/spi-tegra210-quad.c +++ b/drivers/spi/spi-tegra210-quad.c @@ -1552,15 +1552,30 @@ static irqreturn_t handle_dma_based_xfer(struct teg= ra_qspi *tqspi) static irqreturn_t tegra_qspi_isr_thread(int irq, void *context_data) { struct tegra_qspi *tqspi =3D context_data; + u32 status; + + /* + * Read transfer status to check if interrupt was triggered by transfer + * completion + */ + status =3D tegra_qspi_readl(tqspi, QSPI_TRANS_STATUS); =20 /* * Occasionally the IRQ thread takes a long time to wake up (usually * when the CPU that it's running on is excessively busy) and we have * already reached the timeout before and cleaned up the timed out * transfer. Avoid any processing in that case and bail out early. + * + * If no transfer is in progress, check if this was a real interrupt + * that the timeout handler already processed, or a spurious one. */ - if (!tqspi->curr_xfer) - return IRQ_NONE; + if (!tqspi->curr_xfer) { + /* Spurious interrupt - transfer not ready */ + if (!(status & QSPI_RDY)) + return IRQ_NONE; + /* Real interrupt, already handled by timeout path */ + return IRQ_HANDLED; + } =20 tqspi->status_reg =3D tegra_qspi_readl(tqspi, QSPI_FIFO_STATUS); =20 --=20 2.47.3 From nobody Mon Feb 9 08:12:10 2026 Received: from mail-oo1-f42.google.com (mail-oo1-f42.google.com [209.85.161.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4B7A32940D for ; Fri, 16 Jan 2026 10:42:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768560128; cv=none; b=AjliTalWIiGZYELgqPWshpfqHCJ/jbF4UoZEquXIkXFoZNsk7mJsTaSzfkkZPWH9bgA5iH3OHCwF8jDGN9/bMN/oJA/oNSI/pjpmeh5xS0lNMW57+ftA7pvTr8qAhOlIVrmrbKSubQvhvSoZFKSIqRnx+l4bT8qDr+vKWDezOdo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768560128; c=relaxed/simple; bh=7Bs83/3GKpZIet4A+GEy6AGATI40T938TARAD1FqpVU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=DR/6/Xck+G8+i0KKAgvqw6fsCwC4bNBNeaylmTnSRObTPfQ/VexT0aVXL7K232+v5NzP02hu0LMB1BsVJhBcMZJs9SnzifPdC9h6zB5xG2+Jid+T5zeMS4jFqp07+NqXxkQji6mT3QWqpa2UAkF3zjY6lGwrIMJqbGO/IQOX5mg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.161.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-oo1-f42.google.com with SMTP id 006d021491bc7-65f59501dacso1373831eaf.0 for ; Fri, 16 Jan 2026 02:42:00 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768560119; x=1769164919; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=sH5vxI6dNW/ff+71XEyDBEVLOLjPNS7CrwRsoGXUEMk=; b=oqrCpKy5L4prBCZU3hsRW/UEPjXPpTmx8iJQ8SC7aMrL/Ch8cMsw10xsmtspR4san9 iwUS7VYgAXwM+1P7ORQHi7yFAlXtCihMlc8fYx3nHNs9EMCC5gRAbi/S4yk1BHCSN3Fy bs4tRSacNE53VEKAUAtdSdBT6L1AuFh0dVFJqETHFoQKubVOgjWETFSbf61IWBun7FI2 1TH+LBJ2rlElKjF89vi3pxZUOlrtavnDPoGQlOcNiG4+fLrwsCxT/zDgXSQ6kHEHPzoM 609dAuadNwXdLfkwpSXFOaHE6StTaAEzvT0p4TRprSipvg2py+Rn9VyS+jqpuvRvNvXE 8J3w== X-Forwarded-Encrypted: i=1; AJvYcCWKbQLMQgCvA6As1+tpe/qk2QWVwA1FscDI8IlwXKl5RPbo8ITzdM+G9n/TJLfyrIPAEZqJnn7Z9hAmEVw=@vger.kernel.org X-Gm-Message-State: AOJu0YzFCiDfwzq9Cv3JX9HFxufv5TRZwICSHljmcyanCngotBZO5k/I D0Vnt4Cs8cW8sYDu8+uhQi/gGF+ErYL+x4FgIUpoTs1ehSu0vy9j1Bme X-Gm-Gg: AY/fxX44DZUzNbbDpXz0XJR11Y9sQ+kAN4UaFUhTWB8ZHZSFVe8tL37Gc/nqcJpfwkg CK39XshqwAlR1PyUU6Hmq8+4BEIi/AWbLRXw3+sZzAGuxFq2s/cb5nSI1AfeRTTo7x+ykWXGlyL /u0L7qMZuLPulk1os3Aw65HV8C/TshVuBnjbcLbozHKtUqxxK7KSd2Ok+793dYZPrWlRQLJ7goO X/sjZPISaxcNe/gbO4oWs627Y65D0QfRywpEXMsU1fA/XUL7yc6J85rhSUh5GUoK4IzyUF+EHJr NxZ4IKee2gBW9m5pjsLCuHmnl4OMiQricbY6mOdf3aJSFRqD6VQNK9JnwaqoJzGBE053tM2Kd9K U6fuD2YsBQrnu8dRUGIWWv5eyh7ypxwQYyFuq5E05H9Up1oyg+ZQspiV6mEIVJzt1MR6N6p+2FG TqmmGsIawr5mfb X-Received: by 2002:a05:6820:222a:b0:65d:363:b874 with SMTP id 006d021491bc7-66117990118mr1027149eaf.32.1768560119255; Fri, 16 Jan 2026 02:41:59 -0800 (PST) Received: from localhost ([2a03:2880:10ff:56::]) by smtp.gmail.com with ESMTPSA id 586e51a60fabf-4044bd150dasm1639426fac.14.2026.01.16.02.41.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Jan 2026 02:41:58 -0800 (PST) From: Breno Leitao Date: Fri, 16 Jan 2026 02:41:42 -0800 Subject: [PATCH 2/6] spi: tegra210-quad: Move curr_xfer read inside spinlock Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260116-tegra_xfer-v1-2-02d96c790619@debian.org> References: <20260116-tegra_xfer-v1-0-02d96c790619@debian.org> In-Reply-To: <20260116-tegra_xfer-v1-0-02d96c790619@debian.org> To: Thierry Reding , Jonathan Hunter , Sowjanya Komatineni , Laxman Dewangan , Mark Brown , Vishwaroop A Cc: Thierry Reding , linux-tegra@vger.kernel.org, linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Breno Leitao , kernel-team@meta.com, puranjay@kernel.org, usamaarif642@gmail.com X-Mailer: b4 0.15-dev-47773 X-Developer-Signature: v=1; a=openpgp-sha256; l=1886; i=leitao@debian.org; h=from:subject:message-id; bh=7Bs83/3GKpZIet4A+GEy6AGATI40T938TARAD1FqpVU=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBpahXyQcmiX+lZ6+VH1IlXn9H2/Ow+031UEs7B1 9pJkFfc28SJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCaWoV8gAKCRA1o5Of/Hh3 bS7DD/9DE0jwX2tOQ8Bch5QwkoSGgWuEnWGW62EJ8jGhgF8Q4Zuqhdwg45Fol0ls57+b1n/JoHt so8t5Cc9inZQqQqUJyifNjdhj168nrbkWC0Wn+hXlSL2mXT/Pt9peV+9yv+zpmQ0a4eSbdzMcUe YZZGMMTSyLdrJ+6RAvKWOxeOzPqOfWrX/hoi5cdSVEcTYChZUYlJbfuEEYw55iY9dmYBgjMiqgG KzRawCzdM3l98ObQluHtv212HYJlRWAUijDNsl3HpKHWHvdL8oi0kI0MVvw6C511kKAvlRlmnLy HDqsj/u8rsjZoSzYz0rOkXIyb8Z839JjE2be6zPGAbKo5W4jtzzg/AIRskCsTwWgobkvCVL0+B4 v+WLk/qN54dWt/dyShTJgE7t9CTTMGcdIW51PGy4/FPe1B2GaOc7pwkEhDBQQDZUsxhlhzHMTlw zufcm2X99yGwpd5DnSzDc0a7QwOOAoGYm65xizvqsAtsqUAEG3/hjwXrgp4Azcm5qyG8tCWcb1X GxOWmT+Yn0CYs2s8ZtPjEj2dNSGSKG6+HRywgZtfnReBgYWfRDtGlbb2Cme1Ffuhmj7LlMSdLS/ eeTIDkht/+X42QhFBiNGh4Un+EjnEaQeBIpj2j+RBCwHg/qAEuBm5wRM4Z8goI+BbVANHqO8E29 hQnDuJEl5Wybfyw== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D Move the assignment of the transfer pointer from curr_xfer inside the spinlock critical section in both handle_cpu_based_xfer() and handle_dma_based_xfer(). Previously, curr_xfer was read before acquiring the lock, creating a window where the timeout path could clear curr_xfer between reading it and using it. By moving the read inside the lock, the handlers are guaranteed to see a consistent value that cannot be modified by the timeout path. Fixes: 921fc1838fb0 ("spi: tegra210-quad: Add support for Tegra210 QSPI con= troller") Signed-off-by: Breno Leitao Acked-by: Thierry Reding --- drivers/spi/spi-tegra210-quad.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-qua= d.c index f0408c0b4b98..ee291b9e9e9c 100644 --- a/drivers/spi/spi-tegra210-quad.c +++ b/drivers/spi/spi-tegra210-quad.c @@ -1440,10 +1440,11 @@ static int tegra_qspi_transfer_one_message(struct s= pi_controller *host, =20 static irqreturn_t handle_cpu_based_xfer(struct tegra_qspi *tqspi) { - struct spi_transfer *t =3D tqspi->curr_xfer; + struct spi_transfer *t; unsigned long flags; =20 spin_lock_irqsave(&tqspi->lock, flags); + t =3D tqspi->curr_xfer; =20 if (tqspi->tx_status || tqspi->rx_status) { tegra_qspi_handle_error(tqspi); @@ -1474,7 +1475,7 @@ static irqreturn_t handle_cpu_based_xfer(struct tegra= _qspi *tqspi) =20 static irqreturn_t handle_dma_based_xfer(struct tegra_qspi *tqspi) { - struct spi_transfer *t =3D tqspi->curr_xfer; + struct spi_transfer *t; unsigned int total_fifo_words; unsigned long flags; long wait_status; @@ -1513,6 +1514,7 @@ static irqreturn_t handle_dma_based_xfer(struct tegra= _qspi *tqspi) } =20 spin_lock_irqsave(&tqspi->lock, flags); + t =3D tqspi->curr_xfer; =20 if (num_errors) { tegra_qspi_dma_unmap_xfer(tqspi, t); --=20 2.47.3 From nobody Mon Feb 9 08:12:10 2026 Received: from mail-oi1-f195.google.com (mail-oi1-f195.google.com [209.85.167.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB44536166C for ; Fri, 16 Jan 2026 10:42:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768560128; cv=none; b=pIQMnzRjnK8kc/vFDztT0EVmFBJmd/OHUTNhilCN1UEEat5/0BlmpFiC01wYKEb54nTADazHlgg6OD22wSXUoQk84U+lcOY6SyO9JNOeChdl/XYrYzpRzuhYcaQQxbH8wMbCQZikDy1y+DDmpUvTxCSN59YmVDGysymPhshUlSw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768560128; c=relaxed/simple; bh=q2e+6agVTigOW71GtNKg77/ACMqS2Wt0HY6x1VxcF0g=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=EPq3/bM5mmF5IHZATEwhmVXhW+9KJz0snirp0sZZLf5n0ZXdfWTYza3pMaAKLbUJGCid0bIOKpLpyfUEmOT8eshYM/vHwSyyphblWRLatsFyOhIvVib6Kit+jYwDRWEDsTyrfs6tCwgFQJYps2PR77LFQuaV4GCUZiw27D2w7c8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.167.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-oi1-f195.google.com with SMTP id 5614622812f47-45c78da5936so1505889b6e.1 for ; Fri, 16 Jan 2026 02:42:03 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768560121; x=1769164921; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=Sdh9rVcZTiHjEuI7u09tr10D8l/P9Z+QisZcCSJfFr0=; b=OEzUas9azfZqmfuMOYEJI62WS0g7/O/O6EIVaLcebuul5SXV4A2sJHqWKGXoIH2Wuu wADLP5HIKdhlisaeMUKFqmujIbgMvYBZnq1U8Mdz5qbPML49ODsWT57tjKOxn46EKG2Y lNh9rpDqykpfafrn4EcgD3WHNlUxlWX28KR/SVCi+LnPx4dL+sOnme1N80ZWlouTYS6q ZACDN7yq294hSRtO2Se3JPvTWuPwX+jedmoE005kLsNQYgE0C49X/bOnbYR9nFeZloXc +Q3PP+GQf/sUl0Jb/f8MBk3lXZRoaHfqGjasgR/kJcIpD6vOEYYAuINS/haNr78I+o9X qrgA== X-Forwarded-Encrypted: i=1; AJvYcCXBkAfeGDLS8Q8hfm8n+08laSc4L+n4sxMxLMhSYVi+v+J5fsutU8cGKk0iAv7f/mZH8NiwdXX4NvS7P1I=@vger.kernel.org X-Gm-Message-State: AOJu0YzETsCbH1CejZbNlvv45qyIih0a3QHq9gGa6OisrgZCqGV4SquQ gseii7hwfu/OqpXnRgcmug53f38WbeAmPlolcZilig/fIZSjiQORQxSK X-Gm-Gg: AY/fxX5/MyFxem9lfhW+EY2FjuTHzg0N7bjZZ9FMlTH4Gaml4MoaHSsYHw8gWkEVPVW 5bg6LoPrDLj6rs6Aa7nkmgiWneEPL+R6lFFul1TXaQ4v4HndjBRSt3c5bT9tlvTDjDQCOeDuvsa kHkJdPuVpemlblw6RRpz66imi3KUEEIeE4m6fvSbwzfYYZAkxel3qtOV7fgPtL/Q64UVx5rXTvx KQm9x7oQ/alm3F4WAjt/Dm3AVZQq8hxzUGRgNzfbN1Hit4uzIdA11YCNls2jE0zG1UOufglpZgw It9bANEpHwNRPZ7m9+3+TYHLG413L8hdx7cHpyOyM8GXoKCIocf1OhymzCJWGyNX1jEza88eLMB vBCGh4Woal1Q4jzJ/9wrSGiVpJ5w/fNaVIbjL7/p6vRAIxHycVSfyfzNNJnfTNZeQqRjfDtHRL2 mxuA== X-Received: by 2002:a05:6808:f05:b0:453:ea2:36d9 with SMTP id 5614622812f47-45c9c9186bfmr997935b6e.32.1768560120730; Fri, 16 Jan 2026 02:42:00 -0800 (PST) Received: from localhost ([2a03:2880:10ff:40::]) by smtp.gmail.com with ESMTPSA id 5614622812f47-45c9decace9sm1146453b6e.4.2026.01.16.02.41.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Jan 2026 02:42:00 -0800 (PST) From: Breno Leitao Date: Fri, 16 Jan 2026 02:41:43 -0800 Subject: [PATCH 3/6] spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260116-tegra_xfer-v1-3-02d96c790619@debian.org> References: <20260116-tegra_xfer-v1-0-02d96c790619@debian.org> In-Reply-To: <20260116-tegra_xfer-v1-0-02d96c790619@debian.org> To: Thierry Reding , Jonathan Hunter , Sowjanya Komatineni , Laxman Dewangan , Mark Brown , Vishwaroop A Cc: Thierry Reding , linux-tegra@vger.kernel.org, linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Breno Leitao , kernel-team@meta.com, puranjay@kernel.org, usamaarif642@gmail.com X-Mailer: b4 0.15-dev-47773 X-Developer-Signature: v=1; a=openpgp-sha256; l=1831; i=leitao@debian.org; h=from:subject:message-id; bh=q2e+6agVTigOW71GtNKg77/ACMqS2Wt0HY6x1VxcF0g=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBpahXycz1W/zp1J6VAOcPgx7qzzOH1pxMC8X/HJ mRg6HdQDE2JAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCaWoV8gAKCRA1o5Of/Hh3 bdWbEACZqEE0+NRv9hoyDWpSFrOTkr59WK9sr7/7Pozic8udHe3Mk1T2NN14LDnLngiWnlJ/2TQ 1/lwvn4Ar+8iUy4cwC2siTNeBDweMRaq2W1yvxnglfWredWDnbvHmC6q175FFdNQQYSWR2gxt/8 dqKhOJ1oEDCNQWRWZioQGTzhoGv5HUr5xuApTXu1N8grnic7qwwmvAiUL33mccuIO01QDelnev9 NpmwMwNPaoL1XmqnC3noKEWijIDTVKToOwYM/1jztSuhgX5gMZfLUYAu4e9YjJA4dtdXYL6PsHV MN0UHbfXEoTPvZEv1KNIm+LEDdW7r8UsVd9VEcZKcunrRBS48PoXACimv3njy78uEwA8ufFXMg2 RPX3+29m8hX9ezTcX83AOfUa/BUgje1sqkDiQ3WMgeVCTVELKreWGi0uJqrTKtOdrd2awApuGhW Xp34DCUjvGR/+MwJXz6QdNAuLJZ5am4s66vwdeCApOaAShXjhdYN8yOV8IjSg78Wh9cudd84zOz 4hvCcM7aYDL7r3NkIZ+jSyv9cJfV4Xgv+vtuxxZEHWKNOqiudVwZifk+mtQMZQNv0qpspwjRS3z 53RcIt6QpF6fhlDGWTrOvIT+jKI6Ufw30h2GpjHKmGHbFD/o+1jcz5R6mCiPNC0DcpDmzKTzEM9 +tgshxVBI6mOFYg== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D When the timeout handler processes a completed transfer and signals completion, the transfer thread can immediately set up the next transfer and assign curr_xfer to point to it. If a delayed ISR from the previous transfer then runs, it checks if (!tqspi->curr_xfer) (currently without the lock also -- to be fixed soon) to detect stale interrupts, but this check passes because curr_xfer now points to the new transfer. The ISR then incorrectly processes the new transfer's context. Protect the curr_xfer assignment with the spinlock to ensure the ISR either sees NULL (and bails out) or sees the new value only after the assignment is complete. Fixes: 921fc1838fb0 ("spi: tegra210-quad: Add support for Tegra210 QSPI con= troller") Signed-off-by: Breno Leitao --- drivers/spi/spi-tegra210-quad.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-qua= d.c index ee291b9e9e9c..15c110c00aca 100644 --- a/drivers/spi/spi-tegra210-quad.c +++ b/drivers/spi/spi-tegra210-quad.c @@ -839,6 +839,7 @@ static u32 tegra_qspi_setup_transfer_one(struct spi_dev= ice *spi, struct spi_tran u32 command1, command2, speed =3D t->speed_hz; u8 bits_per_word =3D t->bits_per_word; u32 tx_tap =3D 0, rx_tap =3D 0; + unsigned long flags; int req_mode; =20 if (!has_acpi_companion(tqspi->dev) && speed !=3D tqspi->cur_speed) { @@ -846,10 +847,12 @@ static u32 tegra_qspi_setup_transfer_one(struct spi_d= evice *spi, struct spi_tran tqspi->cur_speed =3D speed; } =20 + spin_lock_irqsave(&tqspi->lock, flags); tqspi->cur_pos =3D 0; tqspi->cur_rx_pos =3D 0; tqspi->cur_tx_pos =3D 0; tqspi->curr_xfer =3D t; + spin_unlock_irqrestore(&tqspi->lock, flags); =20 if (is_first_of_msg) { tegra_qspi_mask_clear_irq(tqspi); --=20 2.47.3 From nobody Mon Feb 9 08:12:10 2026 Received: from mail-oi1-f171.google.com (mail-oi1-f171.google.com [209.85.167.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5268F361DA6 for ; Fri, 16 Jan 2026 10:42:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768560130; cv=none; b=BhU/oCwsG2JNNLT0v6skgIKDgWJMQ3V5l576/uZ3YxQFDJNSa9qBWMc1GLKprLGNgUXqwHGkF+LtQESp/OltvEY6nhf7XGWuGUfThLZXZ1l+JFK/G/gwTt46kzgvDsDT5V0ccfRghIvZnivu/04DY3RM34BUrYfZSjo7OCFPffY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768560130; c=relaxed/simple; bh=+gM/8rmoVUIhEKxbIe7M9zBfgjnLSTWPpirV2zKTD7w=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=bH30L0sJtqeaIj+PFOdsJtFG9FvxKpvU5NbRK9kTBrvmZy/KXoW+VJ+MtdEVu3MatGE6tW+otAv0++6GjQuk9XUht/6EDniHCaqvHGQHXKmb0yVnLmS8dUAAr0wvo4tt1CUqjFwEraKo/lKbPfl49+2IH9chqm+G+s6oZTiAV7M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.167.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-oi1-f171.google.com with SMTP id 5614622812f47-45c7a71ba20so514963b6e.2 for ; Fri, 16 Jan 2026 02:42:05 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768560122; x=1769164922; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=9/Q48q0IeRuhiLU39AjZe41jfSGMPYWViJGlNFlddxU=; b=NVl2LGMdBU6LudK6xbG/pzQUAQParTNPJlLxhrjFmSjV3HcfOKGfp2tH/gya/skwwE GUytNt7b+uDKwIvLtHT9WtglNyu0gNHQQfBaA6wt4d7yN39NvjZBZpQg9fspwgv5Jbf5 QUiiYg72RdwoxZO2P1/c3EaFxtXZPvftdqfM8xEBxQyjXq3Ppx5fzUvXCZsBE3r1ih9K 5tZJs2c5lXxAqv08xpYv96SrmBreBLI7SjP0dT7vLlYI1wmKRcd1orkksJjq/BJF8Io4 2ZbSKAt8TQoj2dk5c4CFogp2yLdnVCW6NBFY+1vyrQ1OLdqzZWsvuEqfuXbVe8OAHySh ihyg== X-Forwarded-Encrypted: i=1; AJvYcCXnqEE+/WC4aMqEJ5bYbWIp4WU9mCSKNIZcBd1U0hzn48q+hpgcektgV3kqA9PaL9eiPOkgwNYnyBbmHMg=@vger.kernel.org X-Gm-Message-State: AOJu0YwAluRbdduH1pO9px0coZabTMJfl4u0bNi+LGiZmwEFFn+D6SUo b53kTsb85utWdaYLJ045/ef6/whUbOA1DQUcs/ziaRr+oP+FtL7kyLEq X-Gm-Gg: AY/fxX5oAxg2WUxI8OSrNijhMQJtIrF3A2oz9CYZaO4w9h2uPBwpLav8h9g/Jd9ryVk HQtUptWBeh8BrIjxBRwddpgIS7DxlrRLrdNMTPvHY0GnM897jC5lU7S1Gi7xfIYyFkQ51GuxaXz ivG5llIjCeAWaYuj994+3TKMvbHGrcvKnpSKdQaArOIQbqaIPLhe5aWU5YXdF2+SlyhGwNEKMOH uTEiXe9rBlsgglWHjEZ1yi+XwbuEqdx+w9H/SsMN/FILbagpJvPdkbVycJ+2hQ9ddvbZqAJQjQ4 rUctZYaadl4JPP80gJbIdydce9LMHiH3GLefAxBxk++l+vl2dQnHWV+ROqwVT6DePTQ3EMFKvaY 6S5TifycD0+anDX5lPk/ge8I/b51YLHjnFTFjTAsnJtUzv/fPHeNpSr4UBW4YdXRnenb9NHYX/m 9UlQ== X-Received: by 2002:a05:6808:1987:b0:450:c58d:8c3a with SMTP id 5614622812f47-45c9c197324mr1174687b6e.46.1768560122245; Fri, 16 Jan 2026 02:42:02 -0800 (PST) Received: from localhost ([2a03:2880:10ff:48::]) by smtp.gmail.com with ESMTPSA id 5614622812f47-45c9e0086a4sm1159605b6e.12.2026.01.16.02.42.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Jan 2026 02:42:01 -0800 (PST) From: Breno Leitao Date: Fri, 16 Jan 2026 02:41:44 -0800 Subject: [PATCH 4/6] spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260116-tegra_xfer-v1-4-02d96c790619@debian.org> References: <20260116-tegra_xfer-v1-0-02d96c790619@debian.org> In-Reply-To: <20260116-tegra_xfer-v1-0-02d96c790619@debian.org> To: Thierry Reding , Jonathan Hunter , Sowjanya Komatineni , Laxman Dewangan , Mark Brown , Vishwaroop A Cc: Thierry Reding , linux-tegra@vger.kernel.org, linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Breno Leitao , kernel-team@meta.com, puranjay@kernel.org, usamaarif642@gmail.com X-Mailer: b4 0.15-dev-47773 X-Developer-Signature: v=1; a=openpgp-sha256; l=1795; i=leitao@debian.org; h=from:subject:message-id; bh=+gM/8rmoVUIhEKxbIe7M9zBfgjnLSTWPpirV2zKTD7w=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBpahXyLNJ7iq84eB82zOL5JoFiQtdRTUjOjHDHy fVQ9LMo6UGJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCaWoV8gAKCRA1o5Of/Hh3 bQ9jEACbt6+1pTgBmYLHPVxF3SfGaQoSj+VK3AqdIwMH57jLykLhqPWDjGyEiEBOoFaDuidkye6 CZvQ8mI5XH93opWhN294Ctp+Men+sJ1Y5GlVL6/20WnfB6MDLkZO0SoUxTkY6Ty0t82DHmHdWrg 0XdNzMDRpRt/dmfO3wvDBd7CXDNG/Mt1sno40TXqlRNOfDNc8pLTrtP2qOTPZEyN+CnHF0hxJwB MCmBdJN5pP4w1hdAVBDPEopagzKA1NtwVhkSMpIrxDyL+P0q89rnWzRDivcrn3c4jGVpJF34rGm WwJEEnLyYh4e/RJf7mM+pGxTFEHhl94Bnd9lfhViR4eNdmi51EEiaiOPd7sTtkonFk27sA3GJzO 6QBuF4tc0a6QIKfFAXXR9u5GajuQVKeOdq5aa7yU9mDIZEoUUV2oOGVQWc9ovJtLeiVS1lb+uD2 nX1Ypfgezo8cdZtcLNT4NOG4LprtTkipiX1kDDOcOq7r+DH0KFxb2XzKhBbObCZOVCK3q5dXOmT RdolAzs3DXVDFt/qQIjIXOi+DeKwQ/eWeIiXRc2M00P/TpzVEldcETbI64ZrHy1UcFYQ59z55Ws Mc2pPBroAgksK/IVx2S1Wl8edU++R31E1mQDFTUEL3e/EgEf78VfhYjyJdlhzKqXwORuzENsxO6 dbisWSdjANhedMg== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D The curr_xfer field is read by the IRQ handler without holding the lock to check if a transfer is in progress. When clearing curr_xfer in the combined sequence transfer loop, protect it with the spinlock to prevent a race with the interrupt handler. Protect the curr_xfer clearing at the exit path of tegra_qspi_combined_seq_xfer() with the spinlock to prevent a race with the interrupt handler that reads this field. Without this protection, the IRQ handler could read a partially updated curr_xfer value, leading to NULL pointer dereference or use-after-free. Fixes: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling") Signed-off-by: Breno Leitao --- drivers/spi/spi-tegra210-quad.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-qua= d.c index 15c110c00aca..669e01d3f56a 100644 --- a/drivers/spi/spi-tegra210-quad.c +++ b/drivers/spi/spi-tegra210-quad.c @@ -1161,6 +1161,7 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_= qspi *tqspi, u32 address_value =3D 0; u32 cmd_config =3D 0, addr_config =3D 0; u8 cmd_value =3D 0, val =3D 0; + unsigned long flags; =20 /* Enable Combined sequence mode */ val =3D tegra_qspi_readl(tqspi, QSPI_GLOBAL_CONFIG); @@ -1264,13 +1265,17 @@ static int tegra_qspi_combined_seq_xfer(struct tegr= a_qspi *tqspi, tegra_qspi_transfer_end(spi); spi_transfer_delay_exec(xfer); } + spin_lock_irqsave(&tqspi->lock, flags); tqspi->curr_xfer =3D NULL; + spin_unlock_irqrestore(&tqspi->lock, flags); transfer_phase++; } ret =3D 0; =20 exit: + spin_lock_irqsave(&tqspi->lock, flags); tqspi->curr_xfer =3D NULL; + spin_unlock_irqrestore(&tqspi->lock, flags); msg->status =3D ret; =20 return ret; --=20 2.47.3 From nobody Mon Feb 9 08:12:10 2026 Received: from mail-ot1-f51.google.com (mail-ot1-f51.google.com [209.85.210.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 919AE361668 for ; Fri, 16 Jan 2026 10:42:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768560128; cv=none; b=OjD6qkKLL83W0dLAVNqwEcRi3I5llAquxfQxfph7fw8c73x7NeRsG37wh144XRqCrEYUCh6svruIxN3Wsr2SfJzLhbmVfhNW5diRowjGiqUn16WnHygyWaOmlrd00ZDFmuNPnxclcsaGWjav12di2SaQQUhPe1zTZncUP6zliRQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768560128; c=relaxed/simple; bh=rXTI3sY64hoG5V6aBH3z2wkNQ6wZUnODcq5kb+6G3tU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=TSLddfQJUp48cuLrCfwYx/9TKgfS+st6mHR5Gj2gwLOI1nqRIvSAZupgumqjQ5e5x59kLnModU6aCAwIv/jch1FoyRVVqNtyOH/KNSD+yAvIB5ev6LgBZhkZ7mWK5XDhnUrHagHCuPHfyddbSgHThH+N1vYUJkSL5TrYGf0cQjs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.210.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-ot1-f51.google.com with SMTP id 46e09a7af769-7cfcebf1725so1265884a34.1 for ; Fri, 16 Jan 2026 02:42:04 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768560123; x=1769164923; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=0AA7Y0IuqP0pVl1HcO3QatRU7TWIdgT6ORxtlbMnz/0=; b=pP2Hrbie5X7vMIRcAvUzLjT68J/G19aw+FN3g6c8kayp3uIa8PLKdH4vbxeBGcjxOo ryQfR2tBrsx6Nz/Nl+v0ztUZxWKU0X87+e4n+WY5HENwsOXI9pVE2EpliZ1A00FNHykR skR5f7HMFVVPR6cEkxDAXER1a08emUca/RQ/NK9TtBLgsRc/YZ6H9akbmDWig+CqW42H WC9kxTDRX9i+0BWnvtNrdsiwgeI+tA8kfVbxANQXuU0B/hNRwccS3k03ecdFLT6ZX+3q NSA19u9L0sTLkFKcTh5bIyP4C1burB0ZePH3Uxw1zD8DlIlOAo2hOSPJ5w1kB+PPGacn k68A== X-Forwarded-Encrypted: i=1; AJvYcCVMSUQCh5Iuh16Xug+6guySSkIrEHtuEb2FKM19GnsOyXd9Elz3uMDsGR2ICUpm0nASu93iac4Bc3Qy4zQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yxs5EPpL2jhfBcsB2BQkw5dTmEVTMJGEjtALPy5mjyCB03rOro0 jKkQquY+dhByzp66YZU/U223e0Z6sda67/PdMR8nMDSKdhkZCJKwN2f5 X-Gm-Gg: AY/fxX7+OJG2pdjLx3GIjVu5rAZ+EJWJHSfONIXXEj8IxHQoSehG5nnNI9mj2gra2OL Fq/rUjPw15ZgalVjp9BZybE4ELGtH699wEcoFRstVmmhTJJIZlM7v0E7oN47GUkcHpkfKg0Si6C 7k6MIxSpOHu5zdf5Pskm7FClfXodEubpGsY27V2vI5JbivLo9aYvSmcYGA9h3f5vA7yvqLEPk3y 5JmYzcluevHSbrQAzHidPlxs/NlaScCCn6h7wThcGa8tpbyU3MPd+D1+y2ZEjsFhYB8cOisRLdy gHVq0uKGNkVBCweL/UZa0pz1DI7UmJ2W91Ju0YPDcm0N8H8TC/meuKONVicVv0Jrv8q063hGEIA 7aMG7RCaTGAb/pLe6iYKKfbTV7MTV8bBrE5G27AEGOkwle/5oGTlbIsNN9jzYN3mh5kPss3t6HA == X-Received: by 2002:a05:6830:82e4:b0:7cf:d0b4:bab7 with SMTP id 46e09a7af769-7cfdee8f50emr1640254a34.34.1768560123395; Fri, 16 Jan 2026 02:42:03 -0800 (PST) Received: from localhost ([2a03:2880:10ff::]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7cfdf0d9142sm1480880a34.1.2026.01.16.02.42.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Jan 2026 02:42:02 -0800 (PST) From: Breno Leitao Date: Fri, 16 Jan 2026 02:41:45 -0800 Subject: [PATCH 5/6] spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260116-tegra_xfer-v1-5-02d96c790619@debian.org> References: <20260116-tegra_xfer-v1-0-02d96c790619@debian.org> In-Reply-To: <20260116-tegra_xfer-v1-0-02d96c790619@debian.org> To: Thierry Reding , Jonathan Hunter , Sowjanya Komatineni , Laxman Dewangan , Mark Brown , Vishwaroop A Cc: Thierry Reding , linux-tegra@vger.kernel.org, linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Breno Leitao , kernel-team@meta.com, puranjay@kernel.org, usamaarif642@gmail.com X-Mailer: b4 0.15-dev-47773 X-Developer-Signature: v=1; a=openpgp-sha256; l=1208; i=leitao@debian.org; h=from:subject:message-id; bh=rXTI3sY64hoG5V6aBH3z2wkNQ6wZUnODcq5kb+6G3tU=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBpahXyKDqDLy9UiFdHIdAnuTY95cnWgrnwOfWdb X+yE3bypBGJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCaWoV8gAKCRA1o5Of/Hh3 bfe4EACtv6gkekdzoWC0uBpx8BTg11Qj2SxS+lMOa/KXjIBBZrx9Vq4YfUrFK0WRGupFU9VAA+6 E3rQLJ14PsLpEjBxO1imfKO4yNi6A10oCPKAmL9Svk5VgvPx3KbMcuc9dg8iPCW8aJjdg0rMj9b sEyWXfoa1kIfUGqpSQ5ZyVbZ7qTl8ZBCOL8WRumWVda+QCYWQph8iFVVRoknhyejv1nx/KNbLua yWAef/c6s8JdwA49o5TsD66LhOwDCTAw3B1zu0pgPbwJGd3BcY0DSsikVFs1UyyLl2jASseYPN6 A4VK8cpfci1rSIuXS7V57N0PRhcv4Jno8K06oZP59OqbFHCD+Q7lkGwBP+ojf+R46fmJChCywdZ pLCYs64ioYh3CDNl6usNLABSMxF4U2x6ut4JX0zUECdzRowk4hB5ibbBSgzixZHXHcY5l1g2/Xj waIXTFR6d20JspOHFu8qWBt93haW9vac8wrgm22s5oey13Wlb3k2a1LNZpWSuMo36Jzc7owoHSg mleEkZW4yi3BWXat43Ys/gUixMlmPmsHBMTX25hPruCOWl4Fd9aXBHyhjLEfrZ+MxePO/+FN6jN bjaBDCoEwdwUi8S01QE2iqtv01QNIEMpBQ4BVpNwRFvakn4jjhASR/8Dh1fX+pOAOiSNhTKJTZ7 9J0z3FoDNW9SH2w== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D Protect the curr_xfer clearing in tegra_qspi_non_combined_seq_xfer() with the spinlock to prevent a race with the interrupt handler that reads this field to check if a transfer is in progress. Fixes: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling") Signed-off-by: Breno Leitao --- drivers/spi/spi-tegra210-quad.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-qua= d.c index 669e01d3f56a..79aeb80aa4a7 100644 --- a/drivers/spi/spi-tegra210-quad.c +++ b/drivers/spi/spi-tegra210-quad.c @@ -1288,6 +1288,7 @@ static int tegra_qspi_non_combined_seq_xfer(struct te= gra_qspi *tqspi, struct spi_transfer *transfer; bool is_first_msg =3D true; int ret =3D 0, val =3D 0; + unsigned long flags; =20 msg->status =3D 0; msg->actual_length =3D 0; @@ -1368,7 +1369,9 @@ static int tegra_qspi_non_combined_seq_xfer(struct te= gra_qspi *tqspi, msg->actual_length +=3D xfer->len + dummy_bytes; =20 complete_xfer: + spin_lock_irqsave(&tqspi->lock, flags); tqspi->curr_xfer =3D NULL; + spin_unlock_irqrestore(&tqspi->lock, flags); =20 if (ret < 0) { tegra_qspi_transfer_end(spi); --=20 2.47.3 From nobody Mon Feb 9 08:12:10 2026 Received: from mail-oi1-f176.google.com (mail-oi1-f176.google.com [209.85.167.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 88495361DAE for ; Fri, 16 Jan 2026 10:42:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768560128; cv=none; b=Up5yhPpVNNrltOCci6Mq3T6sMPnd1n/TaZVfvanukwPrl70oDqxpLH34RJJNxUlNPcYBtphte89PCt3p/3v7vbLLuaXZJf83XdPwu9/O82g+mTSlZmkfVvVXzWzShRoLcYWufJ9sBmn28ucdJOiBPbotRYXqD/a2GrfBTrXrobk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768560128; c=relaxed/simple; bh=A/vGZruJ9X8gRAZcaLKj0oeYi4fgmnrSS69XwprVzOU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=dlk8JBmKgcD0xbC/NUZBoUYL7HZycm+h3iw6lgXlmhMjchLa1MsJlqPf3isJf87Z2XAO6dG9clQ0GlGIa47UAz7fkZL2hsyCqdJ2UbYKx4tmx4skbjn4en0HbJmpNCQ/kwFA+NYPeyHt4mo1tZGwRZO80hrvMYGasB8TmWsNp/c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.167.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-oi1-f176.google.com with SMTP id 5614622812f47-45c70afbeebso1111980b6e.0 for ; Fri, 16 Jan 2026 02:42:05 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768560124; x=1769164924; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=Q0ntyY9ECmhz223U3egy0DvK+OimABjT6thpgO5HCR4=; b=XnRbG8z9LEQgj5et5xZiHYjTgw/9vb6WrhQgYntDtyNA/iyVBJlm15pf4u8fAqP1IM pA+b8al6c0ABz2JHfnOu+vOWVYHegP8rNMtTLYWkEmX3F67GZXDll3hikYlH4esIAORT 4LkqBhXbWK2jb9LbGrPXWxtnqee75g7lEUV4VIO+hwZycc4t39gtK2yfEfTkC8NxKELd C/XlGp6Sj4LOxzXirR9ODSwhy+jnduY627ZaIiHtOBuN0b6z+WJeygG3BZdTOdapT5Mi mJFMyNMm0WOVz3n+7jUhnKqFJpypP52qkqvn78iZ2ril5IsUjisHjUqBxgP/KgIfWEqY 5DAA== X-Forwarded-Encrypted: i=1; AJvYcCXNrUjdIVEAcwl57rYrtxIXx49ii1rRRu+yXUbCrQW1djEGzOq2d1VTqutMxyK5z8bfoMkQFv8zaAIH0Us=@vger.kernel.org X-Gm-Message-State: AOJu0YxkU3o0kYjqDbzRvJeOjzcby5i7cpmAdcFtgkpZP+J4/yEBoc1K 0gkf0/In+Yc1FdtAT6cSxINvnF2GyyTYeRiSKsxf5Y3TePrsOw79zGwl X-Gm-Gg: AY/fxX7WA5dIB5Us16ZwIIDWOeg7NT2+kAXjPZ8AG7rk7PPV2fb6imoQ0Qoj+9CW/j3 5lGxt+mF38XSS/chwyv7kPyNVt+cgPVvsIlUADTSJqKVQBIezonFwoFUkdW2nRzqzTWuotAzTPN 1Wmh3bNDfQ5cKb13XebGZvl6/GdD1/D+wf867OuHgg6u1BIH0XeEEA8ZXSZ65YmHf7QnKf0kRLv sQfvRwWrCTVexvuSnEN9B5Tdl9WE9wiz2TeDl/hr7d1PzR4ZSSeuxAvQCzXz+VvAoB+3lYq6ymE Qzpj+jfKhSbszvtulEhTjgtY0Tb8398wRBtizfKN/Ms1mOLi7ZZL8g+TqK1BtW4L41BwSaKXzZ9 2TAr1+fvpCLRVr1ZYfuxj8oWA2FYoYALqdYlTPB00zIsJK/SyWkxHklUbL5H6FRqXXmpUahNfBO jGWg== X-Received: by 2002:a05:6808:1207:b0:453:f85:79e9 with SMTP id 5614622812f47-45c9bf56a2emr1380611b6e.18.1768560124429; Fri, 16 Jan 2026 02:42:04 -0800 (PST) Received: from localhost ([2a03:2880:10ff:72::]) by smtp.gmail.com with ESMTPSA id 5614622812f47-45c9dec3567sm1108687b6e.1.2026.01.16.02.42.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Jan 2026 02:42:04 -0800 (PST) From: Breno Leitao Date: Fri, 16 Jan 2026 02:41:46 -0800 Subject: [PATCH 6/6] spi: tegra210-quad: Protect curr_xfer check in IRQ handler Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260116-tegra_xfer-v1-6-02d96c790619@debian.org> References: <20260116-tegra_xfer-v1-0-02d96c790619@debian.org> In-Reply-To: <20260116-tegra_xfer-v1-0-02d96c790619@debian.org> To: Thierry Reding , Jonathan Hunter , Sowjanya Komatineni , Laxman Dewangan , Mark Brown , Vishwaroop A Cc: Thierry Reding , linux-tegra@vger.kernel.org, linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Breno Leitao , kernel-team@meta.com, puranjay@kernel.org, usamaarif642@gmail.com X-Mailer: b4 0.15-dev-47773 X-Developer-Signature: v=1; a=openpgp-sha256; l=3608; i=leitao@debian.org; h=from:subject:message-id; bh=A/vGZruJ9X8gRAZcaLKj0oeYi4fgmnrSS69XwprVzOU=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBpahXy8Cu2O+/SM4/4A32xveAysDh33iq6q4kwS 2LvH2qMizmJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCaWoV8gAKCRA1o5Of/Hh3 bRNrEACoJkv+kyHRIYdt3hZZpxrLMv8tCkPIuF8cR1aAAU4UvBY+550/SB+LOrQ8kPLADZ02uv7 aRyoTCZmpEE69NjveIRwuVDB46mMstFtVP94Q55R2ty/qzyzKl/Ylhm4aFvZssC0cvi8o/YkEl9 WUTogIAP75n19IwTygHb19ds2Gdq6lexyUu9yJaPh7w1H8f3ebpP8m2jFx/3j2Ie3i4IEF2DQjf CuPjBdARvDOnNXU4WttRpY3Ky/q0Vn7evNiTJA7UmqyQK9PydSvawmOsURORl2mMvE2Ri7l9bxM 336ynw93PsjjoS5dlqvxO8+D4vzTPl33nND2hJ5N7YXloI9oIphyCf69QWI8q0H3kv4zco3LaKr x9lOs+CaaZ/i7qxhm2rB4cBfk3RmySnLKxzEJmyACSMsAW5lYM8RnAvTK4nzYoImj+gcQscbVvm wtWh24Fk01M+NuvklOoPKIHUS+U2nxKVfvSBxZZQFJAxupLL3nV/cP7aLVl0OUeA1KPo4sIJ+0D CyKU/L9N5k6hbXPwNzv5+GT5ItHesBRgv7MRyMm8Ijx4ulCexft1fw1dW4u+RomA3pxnyRn+DT/ +K6OReXiibMtFfR/07cRc7wNYMXTOR/zY3BW5BERV9Ij8UvX0TdOfVB9szHCOA+aszoF66XcLQR Q2dgibsWSj4+cXw== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D Now that all other accesses to curr_xfer are done under the lock, protect the curr_xfer NULL check in tegra_qspi_isr_thread() with the spinlock. Without this protection, the following race can occur: CPU0 (ISR thread) CPU1 (timeout path) ---------------- ------------------- if (!tqspi->curr_xfer) // sees non-NULL spin_lock() tqspi->curr_xfer =3D NULL spin_unlock() handle_*_xfer() spin_lock() t =3D tqspi->curr_xfer // NULL! ... t->len ... // NULL dereference! With this patch, all curr_xfer accesses are now properly synchronized. Although all accesses to curr_xfer are done under the lock, in tegra_qspi_isr_thread() it checks for NULL, releases the lock and reacquires it later in handle_cpu_based_xfer()/handle_dma_based_xfer(). There is a potential for an update in between, which could cause a NULL pointer dereference. To handle this, add a NULL check inside the handlers after acquiring the lock. This ensures that if the timeout path has already cleared curr_xfer, the handler will safely return without dereferencing the NULL pointer. Fixes: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling") Signed-off-by: Breno Leitao --- drivers/spi/spi-tegra210-quad.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-qua= d.c index 79aeb80aa4a7..c0443c986dd9 100644 --- a/drivers/spi/spi-tegra210-quad.c +++ b/drivers/spi/spi-tegra210-quad.c @@ -1457,6 +1457,11 @@ static irqreturn_t handle_cpu_based_xfer(struct tegr= a_qspi *tqspi) spin_lock_irqsave(&tqspi->lock, flags); t =3D tqspi->curr_xfer; =20 + if (!t) { + spin_unlock_irqrestore(&tqspi->lock, flags); + return IRQ_HANDLED; + } + if (tqspi->tx_status || tqspi->rx_status) { tegra_qspi_handle_error(tqspi); complete(&tqspi->xfer_completion); @@ -1527,6 +1532,11 @@ static irqreturn_t handle_dma_based_xfer(struct tegr= a_qspi *tqspi) spin_lock_irqsave(&tqspi->lock, flags); t =3D tqspi->curr_xfer; =20 + if (!t) { + spin_unlock_irqrestore(&tqspi->lock, flags); + return IRQ_HANDLED; + } + if (num_errors) { tegra_qspi_dma_unmap_xfer(tqspi, t); tegra_qspi_handle_error(tqspi); @@ -1565,6 +1575,7 @@ static irqreturn_t handle_dma_based_xfer(struct tegra= _qspi *tqspi) static irqreturn_t tegra_qspi_isr_thread(int irq, void *context_data) { struct tegra_qspi *tqspi =3D context_data; + unsigned long flags; u32 status; =20 /* @@ -1582,7 +1593,9 @@ static irqreturn_t tegra_qspi_isr_thread(int irq, voi= d *context_data) * If no transfer is in progress, check if this was a real interrupt * that the timeout handler already processed, or a spurious one. */ + spin_lock_irqsave(&tqspi->lock, flags); if (!tqspi->curr_xfer) { + spin_unlock_irqrestore(&tqspi->lock, flags); /* Spurious interrupt - transfer not ready */ if (!(status & QSPI_RDY)) return IRQ_NONE; @@ -1599,7 +1612,12 @@ static irqreturn_t tegra_qspi_isr_thread(int irq, vo= id *context_data) tqspi->rx_status =3D tqspi->status_reg & (QSPI_RX_FIFO_OVF | QSPI_RX_FIF= O_UNF); =20 tegra_qspi_mask_clear_irq(tqspi); + spin_unlock_irqrestore(&tqspi->lock, flags); =20 + /* + * TODO: Keep tqspi->lock held for both handle functions below to avoid + * releasing and reacquiring the lock between calls. + */ if (!tqspi->is_curr_dma_xfer) return handle_cpu_based_xfer(tqspi); =20 --=20 2.47.3