From nobody Mon Jun 15 23:14:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 482443E63A2; Tue, 14 Apr 2026 13:45:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; cv=none; b=pMrFwwW0CZpqJ4Yy64FJSVFmHwGYTBkmoNCz0KVouRMFGw8ofkCUr84GzPxuNWBrC+s51GxN4edMakYxrTTV+AuuCxUKz2Dqgm2LfqENiiaXaKSzBzGRdVvncTZtAHqLHmsk6Y1cE6toE5rMeYcct9ZXAtX8xhA0GQbZ+UI8+3g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; c=relaxed/simple; bh=V/4sWGPjPeOS41Y/gfE8l4nfBCZcWrpd6y7kmkEGqiU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LjAOFLQlNc1TRsXGYLCJB1hSFZCzDrzyYQeSi+D13/MYjxBR7mm3hjdX0UbuKLCNlBzy5btPq/YhS3HHYCC/XPS4iSW8iu5qHOesN7RhD3xSokQVuzmfFKcg3Hm+kiXmyckeZVcAIJsDAQJ0zFuzuOPO/+f/Rki64ehFqfIFOdc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Li5MWObn; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Li5MWObn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 02982C2BCB8; Tue, 14 Apr 2026 13:45:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776174341; bh=V/4sWGPjPeOS41Y/gfE8l4nfBCZcWrpd6y7kmkEGqiU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Li5MWObnWJafL0SiadSmbfBq0wvHP+xVn6tK8+I22mihXCAKSgrhyiD1t5R4lv0vK cOUqpU+drNs5fUmox8Ep5ZLCVU71Rm6+PL5pQyQotrpDXmnXS5GfQgGCrYoujJ4y4i sv5zdtELVCtWmDr7t6kzIYHqyFDb3VqRYvEjDb+kwUuAbIBbyP9rniHYsAZxY77caS HqCAKBxHOy/A8duMIFlu6xtj02sEKmH+pTwt7wfI9rrQVZLxYqoAw93ubcQymKJ97h gHhV3D5t1T/uLqIfvV8Eqn1g6E0BxUqRrVfxEN3p84MnrJ0JNwYFpnhOTkubUEXpA8 YMPwxFdyv/X4g== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wCe5C-000000046Vs-2uN0; Tue, 14 Apr 2026 15:45:38 +0200 From: Johan Hovold To: Mark Brown Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Harini Katakam Subject: [PATCH 1/8] spi: cadence: fix controller deregistration Date: Tue, 14 Apr 2026 15:43:12 +0200 Message-ID: <20260414134319.978196-2-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260414134319.978196-1-johan@kernel.org> References: <20260414134319.978196-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: c474b3866546 ("spi: Add driver for Cadence SPI controller") Cc: stable@vger.kernel.org # 3.16 Cc: Harini Katakam Signed-off-by: Johan Hovold --- drivers/spi/spi-cadence.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c index caa7a57e6d27..08d7dabe818d 100644 --- a/drivers/spi/spi-cadence.c +++ b/drivers/spi/spi-cadence.c @@ -777,6 +777,10 @@ static void cdns_spi_remove(struct platform_device *pd= ev) struct spi_controller *ctlr =3D platform_get_drvdata(pdev); struct cdns_spi *xspi =3D spi_controller_get_devdata(ctlr); =20 + spi_controller_get(ctlr); + + spi_unregister_controller(ctlr); + cdns_spi_write(xspi, CDNS_SPI_ER, CDNS_SPI_ER_DISABLE); =20 if (!spi_controller_is_target(ctlr)) { @@ -784,7 +788,7 @@ static void cdns_spi_remove(struct platform_device *pde= v) pm_runtime_set_suspended(&pdev->dev); } =20 - spi_unregister_controller(ctlr); + spi_controller_put(ctlr); } =20 /** --=20 2.52.0 From nobody Mon Jun 15 23:14:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 480923E5EEB; Tue, 14 Apr 2026 13:45:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; cv=none; b=ZFo0YgANmKAdnPw/Ahc8nQqszHrxCte2L+wI55dLn4tx6Jb7xzpn6j3CiJCQWL2sOps0kGWbGyTwv82LZxZYOCfPwgfBmziGCoSN2zP8YMbB68X27piNsyu1AHGrUN3QbnMLsRO4Y3kyZP/jUiCceSzza7IKjVjXFUfr9Sg4oXA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; c=relaxed/simple; bh=4nKgB30aIB1s3NYaScUwvoYU2iS+p8ZIb14gvBLmDNY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dV8rTDJ3a4zGr+yHN4BPl7CVEdelEP2GlwiuBskShyptgqlYaSxwkMMiOuLJpTpaRG7MBTGeKRRJtsVwAjb2d7wWI6Qgdo6RsrqoTqoigJXsEXpSaH7x22tJxXnfMWZIRwubir9TRrRcW9BJFxUZiKi09U7cGilUV78wSJ1Roko= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=N2M4SH8B; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="N2M4SH8B" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 04D8BC4AF09; Tue, 14 Apr 2026 13:45:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776174341; bh=4nKgB30aIB1s3NYaScUwvoYU2iS+p8ZIb14gvBLmDNY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=N2M4SH8BRF136MLoSKABQEd27GsZu/ZzEPogW7ksLBwuFaSOpbXatjuQRyQggFS6a K0FkCpHISvstwBH5n0cTKdKwN7Q72ba3fH1ZPmTfTVfqEbChA0PC3oFrQ1HQlOF0lu 2gFB9IkFdVNd2+XFUb6IaDl8kif/8jb/tCW8NFS18WRgu7d1pQvIwXgEdrNh1lLdcF Mxe5++iGJfFWtlmqsUfFTiBhdLZpRH/+uGy09T5V67T1mW3bliJSr1OemFiKRYHzV0 Ig88iL1IeFW+NYN3XE4ceKRh1pclIDO7V/VKJscJ/pjNbvHwuN5JAb8y0VHLSIHOvu 2e35mzU0N8fcg== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wCe5C-000000046Vu-2xSf; Tue, 14 Apr 2026 15:45:38 +0200 From: Johan Hovold To: Mark Brown Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Khairul Anuar Romli Subject: [PATCH 2/8] spi: cadence-quadspi: fix controller deregistration Date: Tue, 14 Apr 2026 15:43:13 +0200 Message-ID: <20260414134319.978196-3-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260414134319.978196-1-johan@kernel.org> References: <20260414134319.978196-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to deregister the controller before dropping the reference count that allows new operations to start to allow SPI drivers to do I/O during deregistration. Fixes: 7446284023e8 ("spi: cadence-quadspi: Implement refcount to handle un= bind during busy") Cc: stable@vger.kernel.org # 6.17 Cc: Khairul Anuar Romli Signed-off-by: Johan Hovold --- drivers/spi/spi-cadence-quadspi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-qu= adspi.c index 2ead419e896e..50ef65fc5ded 100644 --- a/drivers/spi/spi-cadence-quadspi.c +++ b/drivers/spi/spi-cadence-quadspi.c @@ -2020,13 +2020,13 @@ static void cqspi_remove(struct platform_device *pd= ev) =20 ddata =3D of_device_get_match_data(dev); =20 + spi_unregister_controller(cqspi->host); + refcount_set(&cqspi->refcount, 0); =20 if (!refcount_dec_and_test(&cqspi->inflight_ops)) cqspi_wait_idle(cqspi); =20 - spi_unregister_controller(cqspi->host); - if (cqspi->rx_chan) dma_release_channel(cqspi->rx_chan); =20 --=20 2.52.0 From nobody Mon Jun 15 23:14:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6F93B3E63BE; Tue, 14 Apr 2026 13:45:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; cv=none; b=h3OdJJoD5lQNTUDrVC046q634PdCN8MFohXCjuuUMv/7fRWVotQs/oxIAokRQL2Xv+goARue6UldHqIWOTGvgpOVq8TrNdHllXNZxTHxqAe/+czmEgf9V+PoqbCGjsdM9bz8/d25qsVErmv852Q/4l1rylCHajXJco9UUgpyEyM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; c=relaxed/simple; bh=6w8WzsRo3+kFLD5QPp3YB0Mln9P2TUnV/IBWCbt3Kss=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oLI2R/rLn6NMntNvD1YzcdHih9slzLHGIHrD/eHIGWUGhhwmBj0a822oR5xv/qJik0idoMkFUxeB4NeQeKT4x5TdaeMqWFJP2xt/W4Ply3A4h0DW0ekW2ijBt80RV6+E3/1nYySWrqS86Y4nx2BLBQGxk9KiWACDa0mY8hjI0/0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=qaqXwdzl; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="qaqXwdzl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0BC31C2BCC4; Tue, 14 Apr 2026 13:45:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776174341; bh=6w8WzsRo3+kFLD5QPp3YB0Mln9P2TUnV/IBWCbt3Kss=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qaqXwdzloPbA61Ab6Co7ARFdp1HVm6jK5LsEcAWdRO9aq8tjQBpaGx2HPjCAcRv96 edxfK5Fd5ilkr8fr+vPkbbsSZlB2J88YOCrNiC4dsBqExK4jMEFOIje5pwGwnKzlbP 6fQ2hh0sMzXE+Fka8XNinoB6kWl+Yf0NzLVG0CswfkaWOkfIfcwf2vx0NG7Wb9hLNc DDVbOtvAE+c/nhSzSPO0nvGtA8XBLCM8ijEx1XmmUVwmU9DiK0bRK9yZMxY3tmEkpC s2a8qza0NnBT9RswlruMQLOLPOEoOzxN1I7IuO0N+rczAvLIFdsiP6qpMsJavku86a x3elACTSWPrsw== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wCe5C-000000046Vw-30KL; Tue, 14 Apr 2026 15:45:38 +0200 From: Johan Hovold To: Mark Brown Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Grant Likely , Luotao Fu Subject: [PATCH 3/8] spi: mpc52xx: fix controller deregistration Date: Tue, 14 Apr 2026 15:43:14 +0200 Message-ID: <20260414134319.978196-4-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260414134319.978196-1-johan@kernel.org> References: <20260414134319.978196-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to deregister the controller before disabling and releasing underlying resources like interrupts and gpios during driver unbind. Fixes: 42bbb70980f3 ("powerpc/5200: Add mpc5200-spi (non-PSC) device driver= ") Fixes: b8d4e2ce60b6 ("mpc52xx_spi: add gpio chipselect") Cc: stable@vger.kernel.org # 2.6.33 Cc: Grant Likely Cc: Luotao Fu Signed-off-by: Johan Hovold --- drivers/spi/spi-mpc52xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-mpc52xx.c b/drivers/spi/spi-mpc52xx.c index 05bbd3795e7d..823b49f8ece2 100644 --- a/drivers/spi/spi-mpc52xx.c +++ b/drivers/spi/spi-mpc52xx.c @@ -517,6 +517,8 @@ static void mpc52xx_spi_remove(struct platform_device *= op) struct mpc52xx_spi *ms =3D spi_controller_get_devdata(host); int i; =20 + spi_unregister_controller(host); + cancel_work_sync(&ms->work); free_irq(ms->irq0, ms); free_irq(ms->irq1, ms); @@ -525,7 +527,6 @@ static void mpc52xx_spi_remove(struct platform_device *= op) gpiod_put(ms->gpio_cs[i]); =20 kfree(ms->gpio_cs); - spi_unregister_controller(host); iounmap(ms->regs); spi_controller_put(host); } --=20 2.52.0 From nobody Mon Jun 15 23:14:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 481BF3E6392; Tue, 14 Apr 2026 13:45:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; cv=none; b=kWX7EmS/qfT4Sbiv2uP6/8ZRbQySm2BJFTUdRzt19TrSxYejrUR5Ys9xOaCSdxYq/omgWVyetq3C4ssc+thbA5Xhco92sVM+mZhKv5NpdtFxfgf6NMWBwlrgKFRgIHReAOW1TuJiN4qngG4mub7UjaXdYZ3gkEMKsX/szntUfRQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; c=relaxed/simple; bh=mDyM0wqs7VKfbYheApuB/5tZxef1MmyGMgkj8Ul9x5s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ukL9VpINRFkZgSQ97eWzaabYv8r0He3rVcja3uQzaqWzFM329V4K6ptucwdXotqVY7a6A4xyxOAv6UZDcTk1GkVi4O6IBpPRNODDttuOKIviyjxYs/CVrKoP1wF0Kdg7nZdAWzYV2Byi44MRXGhUMEo8BBHVHAM64zzE/wdxbQk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fKDSXz0w; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fKDSXz0w" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 07337C2BCB0; Tue, 14 Apr 2026 13:45:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776174341; bh=mDyM0wqs7VKfbYheApuB/5tZxef1MmyGMgkj8Ul9x5s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fKDSXz0w7iaZks4PdhFyiEwXGjIf7uGLQ++kNFNGJrjRtrDgEm6umgZQcZWuNYs8e PP/TdBiThqf51ff3FKw2L0LCaWaTiMxkm/Jp7B1Gv5GnKmxXK2xE3rMwVYdWoFW84A O2Ph6kIGkFPuLkO3DWJMdYcZqRdW/MM/JxrBiH08bpPxrYnruPezqUynGxpAN4JFWs nQYNReYdnQrnA/HNPMd9+/Jeu51bQEbOlm3ufYYq/+g9MEQdf5BQIvW1AQE3qlfqdQ FRjvRuLXHSIwLKItO9C8qlgs29M18FfI4yAUnAyT8SjHr7zcWsDCYGZOIM4n1aiD9R J8J6cYbzV6zPQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wCe5C-000000046Vy-32gg; Tue, 14 Apr 2026 15:45:38 +0200 From: Johan Hovold To: Mark Brown Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Pei Xiao Subject: [PATCH 4/8] spi: mpc52xx: fix use-after-free on unbind Date: Tue, 14 Apr 2026 15:43:15 +0200 Message-ID: <20260414134319.978196-5-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260414134319.978196-1-johan@kernel.org> References: <20260414134319.978196-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The state machine work is scheduled by the interrupt handler and therefore needs to be cancelled after disabling interrupts to avoid a potential use-after-free. Fixes: 984836621aad ("spi: mpc52xx: Add cancel_work_sync before module remo= ve") Cc: stable@vger.kernel.org Cc: Pei Xiao Signed-off-by: Johan Hovold --- drivers/spi/spi-mpc52xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-mpc52xx.c b/drivers/spi/spi-mpc52xx.c index 823b49f8ece2..c8c8e6bdf421 100644 --- a/drivers/spi/spi-mpc52xx.c +++ b/drivers/spi/spi-mpc52xx.c @@ -519,10 +519,11 @@ static void mpc52xx_spi_remove(struct platform_device= *op) =20 spi_unregister_controller(host); =20 - cancel_work_sync(&ms->work); free_irq(ms->irq0, ms); free_irq(ms->irq1, ms); =20 + cancel_work_sync(&ms->work); + for (i =3D 0; i < ms->gpio_cs_count; i++) gpiod_put(ms->gpio_cs[i]); =20 --=20 2.52.0 From nobody Mon Jun 15 23:14:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 47FCE3E5ED3; Tue, 14 Apr 2026 13:45:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; cv=none; b=iX1CP9ENFTkCzAy69wbH18H6rJoLfCJw/UWncf5p9bQPFnX4kloNe+il9mUh0iSr1s31Q3e/OOB7z2dQkpeawdT8GB+B0u4OfMF4DTqb0WXtl0eKHBF2eegrTwtnfuGmNRk0eJKoU5mVopEJWXOPgReK1Ft1sHmUjaCJcrTeT8A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; c=relaxed/simple; bh=sBCFg1wFmrRnH1u1Jj2UAJ+YPSqx35GnK209IW14Zng=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oe1i3LajzjoFPSb7lv2f2gHcWog0qCDIqC5pKNtFLuJ7wn5u/jQHm6YF6nuT9ebykSxqYiQ4t00NR9insKWphl/cCMucPaGT1/x5s9sgcZJnAcMQHL2Mm8pZqWVM+XDgU3/pdiQi5MIctb5IosPn0SuOSiGPChe0zqx6mGDfjqY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=nC81lyCv; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="nC81lyCv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 002E2C2BCB6; Tue, 14 Apr 2026 13:45:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776174341; bh=sBCFg1wFmrRnH1u1Jj2UAJ+YPSqx35GnK209IW14Zng=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nC81lyCv278LkAH0ritLY3L/CQM01pncsAphwyH73u5sjA1Q+I1fEnPRgE0mo6r1I BfMEpnsaPWdu0jsFE8wqm53XErZwItolMpnGpL8jlRYErzGy7GHEI9ie+CxgARuIqk MsKuokeGPIvIYKLAvCtl+O2ONPApdBt24J/tyYNOqMp86UV69Zd4klBOibXD8PiSwI RnWxu6E7H0QDsSFfjkrDhk+js43efuj/izuBlFG01PZuW0QqSkI7jqYfoGj8HK0mPD I3a7BM/PaX1aRbU6h6qgBTH1zSXm9Qt13PLQsxZ/bWIOYIrIuABW/eUBnQ8oe9/ZUs 4YXNWKQKHWLHQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wCe5C-000000046W0-34x0; Tue, 14 Apr 2026 15:45:38 +0200 From: Johan Hovold To: Mark Brown Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Mason Yang Subject: [PATCH 5/8] spi: mxic: fix controller deregistration Date: Tue, 14 Apr 2026 15:43:16 +0200 Message-ID: <20260414134319.978196-6-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260414134319.978196-1-johan@kernel.org> References: <20260414134319.978196-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to deregister the controller before disabling underlying resources like clocks (via runtime pm) during driver unbind. Fixes: b942d80b0a39 ("spi: Add MXIC controller driver") Cc: stable@vger.kernel.org # 5.0: cc53711b2191 Cc: stable@vger.kernel.org # 5.0 Cc: Mason Yang Signed-off-by: Johan Hovold --- drivers/spi/spi-mxic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-mxic.c b/drivers/spi/spi-mxic.c index f9369c69911c..b0e7fc828a50 100644 --- a/drivers/spi/spi-mxic.c +++ b/drivers/spi/spi-mxic.c @@ -832,9 +832,10 @@ static void mxic_spi_remove(struct platform_device *pd= ev) struct spi_controller *host =3D platform_get_drvdata(pdev); struct mxic_spi *mxic =3D spi_controller_get_devdata(host); =20 + spi_unregister_controller(host); + pm_runtime_disable(&pdev->dev); mxic_spi_mem_ecc_remove(mxic); - spi_unregister_controller(host); } =20 static const struct of_device_id mxic_spi_of_ids[] =3D { --=20 2.52.0 From nobody Mon Jun 15 23:14:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 805843E6DD0; Tue, 14 Apr 2026 13:45:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; cv=none; b=TZbZzPCh+RKUFdOnPujCYNvIlxbuXZow+yGkbpxSqiHdGega5kUP6QBJnK407KCStqnQnWLm7XFbQQ3jW9KXCX40gXaTUKRLS2988KsfWpORjPX8Cy4KGzxR6xopCC9FEQsMwO6UFtixaY1VHH9YtQc4NyBrWfyJgWrBZmls4bQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; c=relaxed/simple; bh=CD9c1yWD3HCd4mW1xhHDZHS+XcvTESm7Ozt3zqDLBlo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gK+xDc5N1HN5YVWo2YnycLdQs816QGH4nygRPdOSUF0C5bAKYMh7MVHcct2RPctdfA1RUSx83y2vcQxCvfON8ZUftxHTC0N+OilxPuUXC4lCcDDRAPw4z69iNZvfSjh8HYgD0x4OFfzK6xPQFfXAJmnJz2oBLEfGGIx1Xi/A6O8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fItK5kUJ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fItK5kUJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 105B9C2BCC6; Tue, 14 Apr 2026 13:45:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776174341; bh=CD9c1yWD3HCd4mW1xhHDZHS+XcvTESm7Ozt3zqDLBlo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fItK5kUJW2UySYt+TOpsFUrHH2L82bGLvpgb6LxS5MpqFWIrs4rRyhMlEk0zgCWdJ R/btMsJ1gL5i7R8riB2yq3yis0RolBm3ERH5FP85kuUfIFwS91nvaF1yrirM35DGCr gUwmTT9JY+Mpq600KQU5JBiM5Yxv690TJvDmet+xnZm6Zq/P1XYxd5SZkCk/QqATb0 idAsFrZNvpwSH8n16oSCNnQnTlttguR/G6GigV1BdFs7/iP6pjfSJXrsXaU9hcrrGn mDOmAb10j/zoTkT05c1LJqlT/quM2yuO1mpsFX/SnRAiQYlLbzYBfWubaM+rg0kUJx 8H7SoW+beV8/g== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wCe5C-000000046W2-37Fo; Tue, 14 Apr 2026 15:45:38 +0200 From: Johan Hovold To: Mark Brown Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH 6/8] spi: orion: fix controller deregistration Date: Tue, 14 Apr 2026 15:43:17 +0200 Message-ID: <20260414134319.978196-7-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260414134319.978196-1-johan@kernel.org> References: <20260414134319.978196-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: 60cadec9da7b ("spi: new orion_spi driver") Cc: stable@vger.kernel.org # 2.6.27 Signed-off-by: Johan Hovold --- drivers/spi/spi-orion.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c index 7a2186b51b4c..c54cd4ef09bd 100644 --- a/drivers/spi/spi-orion.c +++ b/drivers/spi/spi-orion.c @@ -801,10 +801,15 @@ static void orion_spi_remove(struct platform_device *= pdev) struct spi_controller *host =3D platform_get_drvdata(pdev); struct orion_spi *spi =3D spi_controller_get_devdata(host); =20 + spi_controller_get(host); + + spi_unregister_controller(host); + pm_runtime_get_sync(&pdev->dev); clk_disable_unprepare(spi->axi_clk); =20 - spi_unregister_controller(host); + spi_controller_put(host); + pm_runtime_disable(&pdev->dev); } =20 --=20 2.52.0 From nobody Mon Jun 15 23:14:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6F5F53E63BB; Tue, 14 Apr 2026 13:45:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; cv=none; b=er9brAbxP/+5P/+k2qYe7YYiOLW4X0wUU/Tn7a2hQrQCyP6fdHtlMVf5NE9hiPkcM82r/ROSnBXpFmlxnHEO6o40u9nOJtr8kIR8MhtYib/jGSnzz0rHS0vJ8XJ7d4A16V2qIbgxSzZYOPeTTvyc0o4LPQp+EOfFkqekdAv0H/k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; c=relaxed/simple; bh=UtOj4j3/A/CiozTGbEOHTVtFSRrKzLJQIHHCs2pbwTY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=egieM72aB3j/GvrqJPPwz02eNYWjFs0COaz3xV4qeHet4f/th7NglKznHOMEHhtFFcOY0Anu8Y5ou+Nozd7IhUVuM3xZhMI69Z4EaSz69P8kf7ucpyjAotdYFGc8wyTvbZaWvyihLHCYxJHWty47JbxN1rv8oB/2mvLe99r5zdo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=h2xBDosP; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="h2xBDosP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0E1F3C2BCC7; Tue, 14 Apr 2026 13:45:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776174341; bh=UtOj4j3/A/CiozTGbEOHTVtFSRrKzLJQIHHCs2pbwTY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h2xBDosPgyhJW/SH/UsOa0ug2Wt7aMi4SogWEpYvHwDnCY00mDNaGZGXHIPanIYoY hGLFKJsIIkH3r23B8LZ6W5O9rWhEILx8PAJNwKTZMdpSiQJsGY5AUrXk0rfUO++rgS N6jso5sqVrDyR0YtJToauEgxLk/GMbbFdHuPHZof+A8ztsXRQETgruZQ6p6Bkg6Ncf syrU9p0R8hkBBLbavc8RaFamiYiSGTE+JqAxTbXsEOTVSe1GbV0eDHcvaEt0LhSrO7 vD1A34ynu9jG2jgcpTAc7Lz8c10UawvCCNa/i1zbacFda0JiCe+JGhGVT9LLTdA5wY T/bI4qZK5f+JQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wCe5C-000000046W4-39YT; Tue, 14 Apr 2026 15:45:38 +0200 From: Johan Hovold To: Mark Brown Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Masayuki Ohtake Subject: [PATCH 7/8] spi: topcliff-pch: fix controller deregistration Date: Tue, 14 Apr 2026 15:43:18 +0200 Message-ID: <20260414134319.978196-8-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260414134319.978196-1-johan@kernel.org> References: <20260414134319.978196-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to deregister the controller before disabling and releasing underlying resources like interrupts and DMA during driver unbind. Fixes: e8b17b5b3f30 ("spi/topcliff: Add topcliff platform controller hub (P= CH) spi bus driver") Cc: stable@vger.kernel.org # 2.6.37 Cc: Masayuki Ohtake Signed-off-by: Johan Hovold --- drivers/spi/spi-topcliff-pch.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c index cae2dcefabea..c120436434d0 100644 --- a/drivers/spi/spi-topcliff-pch.c +++ b/drivers/spi/spi-topcliff-pch.c @@ -1406,6 +1406,10 @@ static void pch_spi_pd_remove(struct platform_device= *plat_dev) dev_dbg(&plat_dev->dev, "%s:[ch%d] irq=3D%d\n", __func__, plat_dev->id, board_dat->pdev->irq); =20 + spi_controller_get(data->host); + + spi_unregister_controller(data->host); + if (use_dma) pch_free_dma_buf(board_dat, data); =20 @@ -1433,7 +1437,8 @@ static void pch_spi_pd_remove(struct platform_device = *plat_dev) } =20 pci_iounmap(board_dat->pdev, data->io_remap_addr); - spi_unregister_controller(data->host); + + spi_controller_put(data->host); } #ifdef CONFIG_PM static int pch_spi_pd_suspend(struct platform_device *pd_dev, --=20 2.52.0 From nobody Mon Jun 15 23:14:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 481263E5EF9; Tue, 14 Apr 2026 13:45:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; cv=none; b=QNTCCrVgZBphskVDRrKMiJaUX6Vre651j7KM9S1o9mrgU2hDBwHEB2ikgSooQ8Ao6Wjo3KXX/zFt5i4u+JXQ/cwo6t8GuKcMQvDNuhWZZmGgpOft6hJuq3U4BgarorLlSEPberT7wgoQ0lwKdxtprUZXcXwOEV2CJhgV+ji7zcQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776174341; c=relaxed/simple; bh=53ad1irEqhAo43vfv6Y2SIlO3JtmIiRbHZrk6q58rDc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jK8KzGKsmSsFabJ2Qpi5hPXDrAMcaYV7FV+IzryTIJPiKmPBbtqb6sM6eLBO8mDEYbh+T334iB8hrTTiVvvwaXNAksoYJJ+I+VjT0lBaRnG0BW7Kzs2/rnEMzIL4EzJRMiIqd6MbDE1nQ/xC+BHtq02NG+O2pWTLtiKufbaLbqw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=R0vKlASY; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="R0vKlASY" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0D80C19425; Tue, 14 Apr 2026 13:45:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776174341; bh=53ad1irEqhAo43vfv6Y2SIlO3JtmIiRbHZrk6q58rDc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R0vKlASYt5MrluAcsCDwACVQRViUES3piVCU9s0N75u+9xbRml39UEMnjpEMZOotY 3R18npY4LEe+cOIBMGysxDBDv7azKJe4S6Zouu1qog/Ye8jJFkxH+f0hGp7+ME8IaC FAVI9D3p59ZKgwSHqvVUPq0K24JwqCZn64yUjRswPxTdI24kDymXkro1u7zbAEPbuy cCzTGrPlzr9sjZSvT5L9tyjqOUWU+ckgRYGiZ1cNHOv2Vi7iaq4lXfGO4ujo/7l73x xhSwJzsVaeseuB2PRPsQGJsqi1Qv8U2G2Rxec8NG5e0maPn2HvE51KlY3gm9GJQuba +KUzjdJy0uCzw== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wCe5C-000000046W6-3Bq0; Tue, 14 Apr 2026 15:45:38 +0200 From: Johan Hovold To: Mark Brown Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Tomoya MORINAGA Subject: [PATCH 8/8] spi: topcliff-pch: fix use-after-free on unbind Date: Tue, 14 Apr 2026 15:43:19 +0200 Message-ID: <20260414134319.978196-9-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260414134319.978196-1-johan@kernel.org> References: <20260414134319.978196-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Give the driver a chance to flush its queue before releasing the DMA buffers on driver unbind Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support") Cc: stable@vger.kernel.org # 3.1 Cc: Tomoya MORINAGA Signed-off-by: Johan Hovold --- drivers/spi/spi-topcliff-pch.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c index c120436434d0..14d11450e86d 100644 --- a/drivers/spi/spi-topcliff-pch.c +++ b/drivers/spi/spi-topcliff-pch.c @@ -1410,9 +1410,6 @@ static void pch_spi_pd_remove(struct platform_device = *plat_dev) =20 spi_unregister_controller(data->host); =20 - if (use_dma) - pch_free_dma_buf(board_dat, data); - /* check for any pending messages; no action is taken if the queue * is still full; but at least we tried. Unload anyway */ count =3D 500; @@ -1436,6 +1433,9 @@ static void pch_spi_pd_remove(struct platform_device = *plat_dev) free_irq(board_dat->pdev->irq, data); } =20 + if (use_dma) + pch_free_dma_buf(board_dat, data); + pci_iounmap(board_dat->pdev, data->io_remap_addr); =20 spi_controller_put(data->host); --=20 2.52.0