From nobody Thu Apr 2 17:01:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A1FA3382C5; Fri, 27 Mar 2026 10:43:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774608197; cv=none; b=dSCdPqUMb62iVRo+1KoVuzpiAnC1A2S5nQPRsTRsLa4gOoFsN/iPmRXu7D/mPfnhItWgVWxYG/4nTHDbq647Ho03gdua05sDi8bVYG9S9vZ/hkD+7XthZ5cDpomnR7y4U6SEqUxdamknQkI4dCKN6KR5XokvytOzOemS9g7f34A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774608197; c=relaxed/simple; bh=06nKPiYAs+uiYFgsj7ZNA0z7q+/cAsl7BATEDCAZzvU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=J86svgUuUwpYiGQKKBmvWdsOXHgQrFShmozsi8NDddj400YyQzXsAgAuMxeivTNxEzfPSH2n6+NJmajmR9Pv5AdNiQZHei5uCA8SqmUdY9jSoCjzIPmhTrUL0zsQ9hSimUDQ/DZdnnBMR9Q4HHRgMy1lpeb3XUqEbdfK1eRIkS4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=deG4wqq8; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="deG4wqq8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01322C19423; Fri, 27 Mar 2026 10:43:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774608197; bh=06nKPiYAs+uiYFgsj7ZNA0z7q+/cAsl7BATEDCAZzvU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=deG4wqq8fs9UVE1J4IYK3uajLV0nVUkWcOA2wkeHngrrzZ8oghi+inqmRqmXSTCxL IIb9iTLkKhkmkloIWJykfpfxTMqqUgwSVuv5fxRDbXHv8CCbcWyHbKOcw78CVqFvWE gEnx4k6jg6r9bZQ70DwR8oK2A+pjsw3uYt6ENWN0Ll7FBJyKZCO6HVZvpq8LJ01W9B FeYHa8eEebRkRgJXQXT9txQcYXfQKCWll7W4tPSgbUKIayFUUxQrwEjSvZ+teEj2Jk vXsqY8d75gdpjx1CTypiwef74FgtVrlhXqi6YuoxCW5qRKMBXyJjtjqdcv+h51xUtt fpcguyLLcQXUg== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1w64eo-00000005Um6-3c5X; Fri, 27 Mar 2026 11:43:14 +0100 From: Johan Hovold To: Mark Brown Cc: Johannes Thumshirn , linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH 1/2] spi: ch341: fix memory leaks on probe failures Date: Fri, 27 Mar 2026 11:43:04 +0100 Message-ID: <20260327104305.1309915-2-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260327104305.1309915-1-johan@kernel.org> References: <20260327104305.1309915-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to deregister the controller, disable pins, and kill and free the RX URB on probe failures to mirror disconnect and avoid memory leaks and use-after-free. Also add an explicit URB kill on disconnect for symmetry (even if that is not strictly required as USB core would have stopped it in the current setup). Fixes: 8846739f52af ("spi: add ch341a usb2spi driver") Cc: stable@vger.kernel.org # 6.11 Cc: Johannes Thumshirn Signed-off-by: Johan Hovold --- drivers/spi/spi-ch341.c | 36 +++++++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 11 deletions(-) diff --git a/drivers/spi/spi-ch341.c b/drivers/spi/spi-ch341.c index 2fdb1c020339..ea92ba986201 100644 --- a/drivers/spi/spi-ch341.c +++ b/drivers/spi/spi-ch341.c @@ -173,17 +173,17 @@ static int ch341_probe(struct usb_interface *intf, =20 ch341->tx_buf =3D devm_kzalloc(&udev->dev, CH341_PACKET_LENGTH, GFP_KERNEL); - if (!ch341->tx_buf) - return -ENOMEM; + if (!ch341->tx_buf) { + ret =3D -ENOMEM; + goto err_free_urb; + } =20 usb_fill_bulk_urb(ch341->rx_urb, udev, ch341->read_pipe, ch341->rx_buf, ch341->rx_len, ch341_recv, ch341); =20 ret =3D usb_submit_urb(ch341->rx_urb, GFP_KERNEL); - if (ret) { - usb_free_urb(ch341->rx_urb); - return -ENOMEM; - } + if (ret) + goto err_free_urb; =20 ctrl->bus_num =3D -1; ctrl->mode_bits =3D SPI_CPHA; @@ -195,21 +195,34 @@ static int ch341_probe(struct usb_interface *intf, =20 ret =3D ch341_config_stream(ch341); if (ret) - return ret; + goto err_kill_urb; =20 ret =3D ch341_enable_pins(ch341, true); if (ret) - return ret; + goto err_kill_urb; =20 ret =3D spi_register_controller(ctrl); if (ret) - return ret; + goto err_disable_pins; =20 ch341->spidev =3D spi_new_device(ctrl, &chip); - if (!ch341->spidev) - return -ENOMEM; + if (!ch341->spidev) { + ret =3D -ENOMEM; + goto err_unregister; + } =20 return 0; + +err_unregister: + spi_unregister_controller(ctrl); +err_disable_pins: + ch341_enable_pins(ch341, false); +err_kill_urb: + usb_kill_urb(ch341->rx_urb); +err_free_urb: + usb_free_urb(ch341->rx_urb); + + return ret; } =20 static void ch341_disconnect(struct usb_interface *intf) @@ -219,6 +232,7 @@ static void ch341_disconnect(struct usb_interface *intf) spi_unregister_device(ch341->spidev); spi_unregister_controller(ch341->ctrl); ch341_enable_pins(ch341, false); + usb_kill_urb(ch341->rx_urb); usb_free_urb(ch341->rx_urb); } =20 --=20 2.52.0 From nobody Thu Apr 2 17:01:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 59C0C346A08; Fri, 27 Mar 2026 10:43:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774608197; cv=none; b=b/XDl/9hRAXu1q53j+jp0MfdQaUIC5avvGvH+Igw5Kt8a3jOitehig2b4oqFUJ/AdUgZ4KZg1qecjr4/XKfH5KlirCZnzB08fyJJlkGcilgtsCZxByRyMDaHtdrFR6cSnoRgbB/6HUZXS2oRjVe+JdM6AdK+5xinNufjL7n6KEo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774608197; c=relaxed/simple; bh=P+b/76Q5D8tsdfUser9wn1Tp9CUID1FpPhgoB3vBf+4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DudaJBjpt6qhiTVefH90WKwdvE38nEYEQ8J5d3ZWbpWl8gp6w6+LdrS/DS/zx3YUR2GukA1fibpnKxMDLUdNQgTewG0KA/JVMCW7a5eDeIwXYtjSzDnW1/e22vHsLFU4TvU9FAOZdvi4bvlcS3kJ51uLN3FOTuXpVysMrBQ1KFE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=O6gHhpXw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="O6gHhpXw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 36816C2BC9E; Fri, 27 Mar 2026 10:43:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774608197; bh=P+b/76Q5D8tsdfUser9wn1Tp9CUID1FpPhgoB3vBf+4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=O6gHhpXw0ojhHKTb/cqpZmmwNF0wBYbuoAJI/wDPFobq+BXzKd36JC0CbESFeVOxP qxz90DR1CrWfaxV/u0YcekHEgxKCjFWJ5u898ef+rBabbGzM0MIUUBhj2/5ki1RPQJ cajf69iViWkKQgNTyPOhhDmhdx6mLivlTfcJs9NbSHQOT7OJeNARW8JKZh9wV0iUqj T/whun5mzP/4L2nq3szNCGR+PMmxdwu+oZkoZyEuAtYpRLMzTRqzMqiLc0NHbf4PB2 lLY38lR2fs5e95ynRFbxCzDNiYbjhMin+IibbmgkQdl3uGc4XN0JUY0acWJqIVFyv0 VgrbvzFDLHxjw== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1w64eo-00000005Um8-3ePF; Fri, 27 Mar 2026 11:43:14 +0100 From: Johan Hovold To: Mark Brown Cc: Johannes Thumshirn , linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH 2/2] spi: ch341: fix devres lifetime Date: Fri, 27 Mar 2026 11:43:05 +0100 Message-ID: <20260327104305.1309915-3-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260327104305.1309915-1-johan@kernel.org> References: <20260327104305.1309915-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes). Fix the controller and driver data lifetime so that they are released on driver unbind. Note that this also makes sure that the SPI controller is placed correctly under the USB interface in the device tree. Fixes: 8846739f52af ("spi: add ch341a usb2spi driver") Cc: stable@vger.kernel.org # 6.11 Cc: Johannes Thumshirn Signed-off-by: Johan Hovold --- drivers/spi/spi-ch341.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/spi/spi-ch341.c b/drivers/spi/spi-ch341.c index ea92ba986201..0e71a32900b3 100644 --- a/drivers/spi/spi-ch341.c +++ b/drivers/spi/spi-ch341.c @@ -152,7 +152,7 @@ static int ch341_probe(struct usb_interface *intf, if (ret) return ret; =20 - ctrl =3D devm_spi_alloc_host(&udev->dev, sizeof(struct ch341_spi_dev)); + ctrl =3D devm_spi_alloc_host(&intf->dev, sizeof(struct ch341_spi_dev)); if (!ctrl) return -ENOMEM; =20 @@ -163,7 +163,7 @@ static int ch341_probe(struct usb_interface *intf, ch341->read_pipe =3D usb_rcvbulkpipe(udev, usb_endpoint_num(in)); =20 ch341->rx_len =3D usb_endpoint_maxp(in); - ch341->rx_buf =3D devm_kzalloc(&udev->dev, ch341->rx_len, GFP_KERNEL); + ch341->rx_buf =3D devm_kzalloc(&intf->dev, ch341->rx_len, GFP_KERNEL); if (!ch341->rx_buf) return -ENOMEM; =20 @@ -171,8 +171,7 @@ static int ch341_probe(struct usb_interface *intf, if (!ch341->rx_urb) return -ENOMEM; =20 - ch341->tx_buf =3D - devm_kzalloc(&udev->dev, CH341_PACKET_LENGTH, GFP_KERNEL); + ch341->tx_buf =3D devm_kzalloc(&intf->dev, CH341_PACKET_LENGTH, GFP_KERNE= L); if (!ch341->tx_buf) { ret =3D -ENOMEM; goto err_free_urb; --=20 2.52.0