Regmap initialization triggers regcache_maple_populate() which attempts
SPI read to populate cache. SPI read requires mcp->dev and mcp->addr to
be set, without them, NULL pointer dereference occurs during probe.

Move initialization before mcp23s08_spi_regmap_init() call.

Cc: stable@vger.kernel.org
Fixes: f9f4fda15e72 ("pinctrl: mcp23s08: init reg_defaults from HW at probe and switch cache type")
Signed-off-by: Judith Mendez <jm@ti.com>
---
 drivers/pinctrl/pinctrl-mcp23s08_spi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pinctrl/pinctrl-mcp23s08_spi.c b/drivers/pinctrl/pinctrl-mcp23s08_spi.c
index 54f61c8cb1c0..1e99b2566d5a 100644
--- a/drivers/pinctrl/pinctrl-mcp23s08_spi.c
+++ b/drivers/pinctrl/pinctrl-mcp23s08_spi.c
@@ -173,6 +173,8 @@ static int mcp23s08_probe(struct spi_device *spi)
 	for_each_set_bit(addr, &spi_present_mask, MCP_MAX_DEV_PER_CS) {
 		data->mcp[addr] = &data->chip[--chips];
 		data->mcp[addr]->irq = spi->irq;
+		data->mcp[addr]->dev = dev;
+		data->mcp[addr]->addr = 0x40 | (addr << 1);
 
 		ret = mcp23s08_spi_regmap_init(data->mcp[addr], dev, addr, info);
 		if (ret)
-- 
2.54.0

Hi Judith,

thanks for your patch!

On Fri, May 8, 2026 at 11:43 PM Judith Mendez <jm@ti.com> wrote:

> Regmap initialization triggers regcache_maple_populate() which attempts
> SPI read to populate cache. SPI read requires mcp->dev and mcp->addr to
> be set, without them, NULL pointer dereference occurs during probe.
>
> Move initialization before mcp23s08_spi_regmap_init() call.
>
> Cc: stable@vger.kernel.org
> Fixes: f9f4fda15e72 ("pinctrl: mcp23s08: init reg_defaults from HW at probe and switch cache type")
> Signed-off-by: Judith Mendez <jm@ti.com>
(...)
> +               data->mcp[addr]->dev = dev;
> +               data->mcp[addr]->addr = 0x40 | (addr << 1);

What does this 0x40 mean here? Can you use a #define to specify
exactly what is going on?

Yours,
Linus Walleij

Hi Linus,

On 5/11/26 4:13 AM, Linus Walleij wrote:
> Hi Judith,
> 
> thanks for your patch!
> 
> On Fri, May 8, 2026 at 11:43 PM Judith Mendez <jm@ti.com> wrote:
> 
>> Regmap initialization triggers regcache_maple_populate() which attempts
>> SPI read to populate cache. SPI read requires mcp->dev and mcp->addr to
>> be set, without them, NULL pointer dereference occurs during probe.
>>
>> Move initialization before mcp23s08_spi_regmap_init() call.
>>
>> Cc: stable@vger.kernel.org
>> Fixes: f9f4fda15e72 ("pinctrl: mcp23s08: init reg_defaults from HW at probe and switch cache type")
>> Signed-off-by: Judith Mendez <jm@ti.com>
> (...)
>> +               data->mcp[addr]->dev = dev;
>> +               data->mcp[addr]->addr = 0x40 | (addr << 1);
> 
> What does this 0x40 mean here? Can you use a #define to specify
> exactly what is going on?

Really I am just moving the two definitions up in probe, they will get
re-written later. It is the base WRITE opcode for SPI chips.

I don't know much on this driver/HW, beyond the things I had to debug
when enabling this driver on BeagleBadge with a on board MCP23S18 chip.
So please scrutinize my changes.

Will add a constant definition and respin.

BTW I found another bug so will append to this series.

Thanks for reviewing.

~ Judith