[PATCH v2 0/5] spi: imx: fix use-after-free on unbind

Johan Hovold posted 5 patches 1 week, 3 days ago
drivers/spi/spi-imx.c           | 41 +++++++++++----------------------
drivers/spi/spi-rockchip.c      | 40 +++++++++++++-------------------
drivers/spi/spi-tegra20-slink.c | 26 ++++++++-------------
3 files changed, 40 insertions(+), 67 deletions(-)
[PATCH v2 0/5] spi: imx: fix use-after-free on unbind
Posted by Johan Hovold 1 week, 3 days ago
The SPI subsystem frees the controller and any subsystem allocated
driver data as part of deregistration (unless the allocation is device
managed).

This series fixes the IMX driver that got this wrong and then converts
it to use device managed allocation.

Included are also a (preparatory) deregistration fix for the rockchip
driver and related cleanups for the tegre20-slink and rockchip drivers
that both take a controller reference during unbind.

Johan


Changes in v2
 - add stable tag to rockchip fix
 - move rockchip fix before the cleanups


Johan Hovold (5):
  spi: imx: fix use-after-free on unbind
  spi: rockchip: fix controller deregistration
  spi: imx: switch to managed controller allocation
  spi: tegra20-slink: switch to managed controller allocation
  spi: rockchip: switch to managed controller allocation

 drivers/spi/spi-imx.c           | 41 +++++++++++----------------------
 drivers/spi/spi-rockchip.c      | 40 +++++++++++++-------------------
 drivers/spi/spi-tegra20-slink.c | 26 ++++++++-------------
 3 files changed, 40 insertions(+), 67 deletions(-)

-- 
2.52.0
Re: [PATCH v2 0/5] spi: imx: fix use-after-free on unbind
Posted by Mark Brown 1 week, 2 days ago
On Tue, 24 Mar 2026 09:23:21 +0100, Johan Hovold wrote:
> spi: imx: fix use-after-free on unbind
> 
> The SPI subsystem frees the controller and any subsystem allocated
> driver data as part of deregistration (unless the allocation is device
> managed).
> 
> This series fixes the IMX driver that got this wrong and then converts
> it to use device managed allocation.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-7.1

Thanks!

[1/5] spi: imx: fix use-after-free on unbind
      https://git.kernel.org/broonie/spi/c/1c78c2002380
[2/5] spi: rockchip: fix controller deregistration
      https://git.kernel.org/broonie/spi/c/53e7a16070fe
[3/5] spi: imx: switch to managed controller allocation
      https://git.kernel.org/broonie/spi/c/9c0180650654
[4/5] spi: tegra20-slink: switch to managed controller allocation
      https://git.kernel.org/broonie/spi/c/4ba75403fb4d
[5/5] spi: rockchip: switch to managed controller allocation
      https://git.kernel.org/broonie/spi/c/7f3eb70516c7

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark