summaryrefslogtreecommitdiff
path: root/drivers/spi
AgeCommit message (Collapse)Author
2026-04-09spi: atmel: fix controller deregistrationJohan Hovold
Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: 754ce4f29937 ("[PATCH] SPI: atmel_spi driver") Cc: stable@vger.kernel.org # 2.6.21 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260409120419.388546-5-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-09spi: at91-usart: fix controller deregistrationJohan Hovold
Make sure to deregister the controller before disabling and releasing underlying resources like clocks and DMA during driver unbind. Fixes: e1892546ff66 ("spi: at91-usart: Add driver for at91-usart as SPI") Cc: stable@vger.kernel.org # 4.20 Cc: Radu Pirea <radu.pirea@microchip.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260409120419.388546-4-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-09spi: aspeed-smc: fix controller deregistrationJohan Hovold
Make sure to deregister the controller before disabling it to allow SPI device drivers to do I/O during deregistration. Fixes: e3228ed92893 ("spi: spi-mem: Convert Aspeed SMC driver to spi-mem") Cc: stable@vger.kernel.org # 5.19 Cc: Cédric Le Goater <clg@kaod.org> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260409120419.388546-3-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-09spi: amlogic-spisg: fix controller deregistrationJohan Hovold
Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: cef9991e04ae ("spi: Add Amlogic SPISG driver") Cc: stable@vger.kernel.org # 6.17: b8db95529979 Cc: stable@vger.kernel.org # 6.17 Cc: Sunny Luo <sunny.luo@amlogic.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260409120419.388546-2-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-09spi: npcm-fiu: drop unused remove callbackJohan Hovold
Drop the remove callback which is unused since commit 82c4fadb0b95 ("spi: npcm-fiu: Use helper function devm_clk_get_enabled()"). The above mentioned commit also removed the last user of the platform driver data which no longer needs to be set (twice). Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260409120810.388909-1-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-09spi: atcspi200: enable compile testingJohan Hovold
There seems to be nothing preventing this driver from being compile tested so enable that for wider build coverage. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260409145618.466701-1-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-08spi: pl022: enable compile testingJohan Hovold
There seems to be nothing preventing this driver from being compile tested so enable that for wider build coverage. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260408084407.107416-1-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-08Add Renesas RZ/G3L RSPI supportMark Brown
Biju <biju.das.au@gmail.com> says: This patch series adds binding and driver support for RSPI IP found on the RZ/G3L SoC. The RSPI is compatible with RZ/V2H RSPI, but has 2 clocks compared to 3 on RZ/V2H. Link: https://patch.msgid.link/20260408085418.18770-1-biju.das.jz@bp.renesas.com
2026-04-08spi: rzv2h-rspi: Add support for RZ/G3L (R9A08G046)Biju Das
Add support for RZ/G3L RSPI. The RZ/G3L variant requires only 2 clocks (pclk + tclk), unlike the RZ/V2H which needs 3. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20260408085418.18770-3-biju.das.jz@bp.renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07spi: uniphier: Simplify clock handling with devm_clk_get_enabled()Pei Xiao
Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for the clock. This removes the need for explicit clock enable and disable calls, as the managed API automatically handles clock disabling on device removal or probe failure. Remove the now-unnecessary clk_disable_unprepare() calls from the probe error path and the remove callback. Adjust error labels accordingly. Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Reviewed-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com> Link: https://patch.msgid.link/b2deeefd4ef1a4bce71116aabfcb7e81400f6d37.1775546948.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()Pei Xiao
Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for both "pclk" and "ref_clk". This removes the need for explicit clock enable and disable calls, as the managed API automatically disables the clocks on device removal or probe failure. Remove the now-unnecessary clk_disable_unprepare() calls from the probe error paths and the remove callback. Simplify error handling by jumping directly to the remove_ctlr label. Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Acked-by: Michal Simek <michal.simek@amd.com> Link: https://patch.msgid.link/24043625f89376da36feca2408f990a85be7ab36.1775555500.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07spi: spi-fsl-lpspi: make struct lpspi_config::mode u32Marc Kleine-Budde
The struct lpspi_config::mode holds a copy of the mode of struct spi_device::mode. In commit 937e6d756422 ("spi: expand mode support") the struct spi_device::mode was increased from u16 to u32. Increase the struct lpspi_config::mode to u32 avoid truncating the mode variable. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-11-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07spi: spi-fsl-lpspi: fsl_lpspi_write_tx_fifo(): simplify while() loop checkMarc Kleine-Budde
To simplify the loop check. Combine both conditions of the while() and the directly following if() into the while(). Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-10-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07spi: spi-fsl-lpspi: fsl_lpspi_reset(): convert to void functionMarc Kleine-Budde
The function fsl_lpspi_reset() cannot fail and it's return value is never checked. Simplify the code and convert it into a void function. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-9-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07spi: spi-fsl-lpspi: fsl_lpspi_can_dma(): directly assign return value to ↵Marc Kleine-Budde
fsl_lpspi->usedma The function fsl_lpspi_can_dma() returns a bool. Simplify the code, remove the if/else and assign the return value of fsl_lpspi_can_dma() directly to fsl_lpspi->usedma. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-8-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07spi: spi-fsl-lpspi: fsl_lpspi_setup_transfer(): remove useless spi_transfer ↵Marc Kleine-Budde
NULL pointer check fsl_lpspi_setup_transfer() is either called via: | fsl_lpspi_prepare_message() | -> fsl_lpspi_setup_transfer() or | -> spi_transfer_one_message() | -> controller->transfer_one == fsl_lpspi_transfer_one() | -> fsl_lpspi_setup_transfer() The first call path already has a spi_transfer NULL pointer check, the second one explicitly iterates over all spi_transfer of the spi_message. Simplify the code by removing the useless NULL pointer check. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-7-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07spi: spi-fsl-lpspi: fsl_lpspi_set_cmd(): use FIELD_PREP to encode Transmit ↵Marc Kleine-Budde
Command register Instead of open coding mask and shift operations and to increase readability use FIELD_PREP() to encode the Transmit Command register. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-6-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07spi: spi-fsl-lpspi: fsl_lpspi_set_cmd(): remove obfuscated and obsolete ↵Marc Kleine-Budde
assignment of TCR_CPOL and SPI_CPHA Commit 7ae4d097b752 ("spi: spi-fsl-lpspi: Handle clock polarity and phase") enhances the driver with clock polarity and phase handling. Among other things that commit in fsl_lpspi_set_cmd() explicitly set the bits TCR_CPOL and TCR_CPHA bits in the TCR register depending on their corresponding bits in the SPI mode (SPI_CPOL and SPI_CPHA), to configure clock polarity and phase. That change made the assignment of the lowest 2 bits of lpspi_config::mode shifted by << 30 to the TCR register obsolete. The lowest 2 bits of struct lpspi_config::mode (= SPI_CPOL and SPI_CPHA) match the corresponding bits in the TCR register (TCR_CPOL and TCR_CPHA) if shifted. Keep the better readable and maintainable version provided in commit 7ae4d097b752 ("spi: spi-fsl-lpspi: Handle clock polarity and phase") and remove the obfuscated version. Cc: Marek Vasut <marex@nabladev.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-5-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07spi: spi-fsl-lpspi: fsl_lpspi_set_cmd(): use mode from struct ↵Marc Kleine-Budde
fsl_lpspi_data::config::mode Commit 7ae4d097b752 ("spi: spi-fsl-lpspi: Handle clock polarity and phase") enhances the driver with clock polarity and phase handling. That commit adds a 2nd argument ("struct spi_device *spi") to the fsl_lpspi_set_cmd() function. The "spi" pointer is used to access the "mode" of the current transfer. However the mode is already available via "fsl_lpspi->config.mode". To simplify the driver remove the 2nd argument and use "fsl_lpspi->config.mode" to access the mode. Cc: Marek Vasut <marex@nabladev.com> Reviewed-by: Marek Vasut <marex@nabladev.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-4-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07spi: spi-fsl-lpspi: fsl_lpspi_set_watermark(): use FIELD_PREP() to encode ↵Marc Kleine-Budde
FIFO Control register Instead of open coding mask and shift operations and to increase readability use FIELD_PREP() to encode the FIFO Control register. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-2-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07spi: spi-fsl-lpspi: adapt to kernel coding styleMarc Kleine-Budde
Adapt the driver to current kernel coding style standards. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-cleanups-v2-1-02b56c5d44a8@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-01spi: ch341: fix devres lifetimeJohan Hovold
USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without their devices being physically disconnected (e.g. on probe deferral or configuration changes). Fix the controller and driver data lifetime so that they are released on driver unbind. Note that this also makes sure that the SPI controller is placed correctly under the USB interface in the device tree. Fixes: 8846739f52af ("spi: add ch341a usb2spi driver") Cc: stable@vger.kernel.org # 6.11 Cc: Johannes Thumshirn <jth@kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260327104305.1309915-3-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-01spi: ch341: fix memory leaks on probe failuresJohan Hovold
Make sure to deregister the controller, disable pins, and kill and free the RX URB on probe failures to mirror disconnect and avoid memory leaks and use-after-free. Also add an explicit URB kill on disconnect for symmetry (even if that is not strictly required as USB core would have stopped it in the current setup). Fixes: 8846739f52af ("spi: add ch341a usb2spi driver") Cc: stable@vger.kernel.org # 6.11 Cc: Johannes Thumshirn <jth@kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260327104305.1309915-2-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-30spi: cadence-qspi: Fix exec_mem_op error handlingEmanuele Ghidoli
cqspi_exec_mem_op() increments the runtime PM usage counter before all refcount checks are performed. If one of these checks fails, the function returns without dropping the PM reference. Move the pm_runtime_resume_and_get() call after the refcount checks so that runtime PM is only acquired when the operation can proceed and drop the inflight_ops refcount if the PM resume fails. Cc: stable@vger.kernel.org Fixes: 7446284023e8 ("spi: cadence-quadspi: Implement refcount to handle unbind during busy") Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com> Link: https://patch.msgid.link/20260313135236.46642-1-ghidoliemanuele@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-30spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() ↵Felix Gu
callback aml_sfc_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action after successful registration so nand_ecc_unregister_on_host_hw_engine() runs automatically on probe failures and during device removal. Fixes: 4670db6f32e9 ("spi: amlogic: add driver for Amlogic SPI Flash Controller") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Link: https://patch.msgid.link/20260322-spifc-a4-v1-1-2dc5ebcbe0a9@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-30spi: stm32-ospi: Fix DMA channel leak on stm32_ospi_dma_setup() failureFelix Gu
When stm32_ospi_dma_setup() fails, the DMA channels allocated by stm32_ospi_get_resources() were never released. Add proper cleanup in the error path. Fixes: e35a7607e05d ("spi: stm32-ospi: Set DMA maxburst dynamically") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://patch.msgid.link/20260329-stm32-ospi-v1-2-142122466412@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-30spi: stm32-ospi: Fix reset control leak on probe errorFelix Gu
When spi_register_controller() fails after reset_control_acquire() succeeds, the reset control is never released. This causes a resource leak in the error path. Add the missing reset_control_release() call in the error path. Fixes: cf2c3eceb757 ("spi: stm32-ospi: Make usage of reset_control_acquire/release() API") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://patch.msgid.link/20260329-stm32-ospi-v1-1-142122466412@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-30spi: stm32-ospi: Fix resource leak in remove() callbackFelix Gu
The remove() callback returned early if pm_runtime_resume_and_get() failed, skipping the cleanup of spi controller and other resources. Remove the early return so cleanup completes regardless of PM resume result. Fixes: 79b8a705e26c ("spi: stm32: Add OSPI driver") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://patch.msgid.link/20260329-ospi-v1-1-cc8cf1c82c4a@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-26device property: Make modifications of fwnode "flags" thread safeDouglas Anderson
In various places in the kernel, we modify the fwnode "flags" member by doing either: fwnode->flags |= SOME_FLAG; fwnode->flags &= ~SOME_FLAG; This type of modification is not thread-safe. If two threads are both mucking with the flags at the same time then one can clobber the other. While flags are often modified while under the "fwnode_link_lock", this is not universally true. Create some accessor functions for setting, clearing, and testing the FWNODE flags and move all users to these accessor functions. New accessor functions use set_bit() and clear_bit(), which are thread-safe. Cc: stable@vger.kernel.org Fixes: c2c724c868c4 ("driver core: Add fw_devlink_parse_fwtree()") Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Mark Brown <broonie@kernel.org> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Saravana Kannan <saravanak@kernel.org> Link: https://patch.msgid.link/20260317090112.v2.1.I0a4d03104ecd5103df3d76f66c8d21b1d15a2e38@changeid [ Fix fwnode_clear_flag() argument alignment, restore dropped blank line in fwnode_dev_initialized(), and remove unnecessary parentheses around fwnode_test_flag() calls. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-26spi: Use trace_call__##name() at guarded tracepoint call sitesVineeth Pillai (Google)
Replace trace_foo() with the new trace_call__foo() at sites already guarded by trace_foo_enabled(), avoiding a redundant static_branch_unlikely() re-evaluation inside the tracepoint. trace_call__foo() calls the tracepoint callbacks directly without utilizing the static branch again. Cc: Michael Hennerich <michael.hennerich@analog.com> Cc: Nuno Sá <nuno.sa@analog.com> Cc: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20260323160052.17528-14-vineeth@bitbyteword.org Suggested-by: Steven Rostedt <rostedt@goodmis.org> Suggested-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Vineeth Pillai (Google) <vineeth@bitbyteword.org> Assisted-by: Claude:claude-sonnet-4-6 Acked-by: Mark Brown <broonie@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-03-26spi: spi-fsl-lpspi: fix teardown order issue (UAF)Marc Kleine-Budde
There is a teardown order issue in the driver. The SPI controller is registered using devm_spi_register_controller(), which delays unregistration of the SPI controller until after the fsl_lpspi_remove() function returns. As the fsl_lpspi_remove() function synchronously tears down the DMA channels, a running SPI transfer triggers the following NULL pointer dereference due to use after free: | fsl_lpspi 42550000.spi: I/O Error in DMA RX | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] | Call trace: | fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi] | fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi] | spi_transfer_one_message+0x49c/0x7c8 | __spi_pump_transfer_message+0x120/0x420 | __spi_sync+0x2c4/0x520 | spi_sync+0x34/0x60 | spidev_message+0x20c/0x378 [spidev] | spidev_ioctl+0x398/0x750 [spidev] [...] Switch from devm_spi_register_controller() to spi_register_controller() in fsl_lpspi_probe() and add the corresponding spi_unregister_controller() in fsl_lpspi_remove(). Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-fixes-v1-1-b433e435b2d8@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-26spi: fix use-after-free on managed registration failureJohan Hovold
The SPI API is asymmetric and the controller is freed as part of deregistration (unless it has been allocated using devm_spi_alloc_host/target()). A recent change converting the managed registration function to use devm_add_action_or_reset() inadvertently introduced a (mostly theoretical) regression where a non-devres managed controller could be freed as part of failed registration. This in turn would lead to use-after-free in controller driver error paths. Fix this by taking another reference before calling devm_add_action_or_reset() and not releasing it on errors for non-devres allocated controllers. An alternative would be a partial revert of the offending commit, but it is better to handle this explicitly until the API has been fixed (e.g. see 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation")). Fixes: b6376dbed8e1 ("spi: Simplify devm_spi_*_controller()") Reported-by: Felix Gu <ustc.gu@gmail.com> Link: https://lore.kernel.org/all/20260324145548.139952-1-ustc.gu@gmail.com/ Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Johan Hovold <johan@kernel.org> Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260325145319.1132072-1-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-24spi: pxa2xx: update outdated reference to pump_transfers()Kexin Sun
The function pump_transfers() was split into pxa2xx_spi_transfer_one(), pxa2xx_spi_handle_err() and pxa2xx_spi_set_cs() in commit d5898e19c0d7 ("spi: pxa2xx: Use core message processing loop"). The comment in pxa2xx_spi_dma_transfer_complete() still warns about concurrent calls to pump_transfers(), but the actual operation protected by dma_running is now spi_finalize_current_transfer(). Update the reference. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun <kexinsun@smail.nju.edu.cn> Link: https://patch.msgid.link/20260321105945.8224-1-kexinsun@smail.nju.edu.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-24spi: use generic driver_override infrastructureDanilo Krummrich
When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Also note that we do not enable the driver_override feature of struct bus_type, as SPI - in contrast to most other buses - passes "" to sysfs_emit() when the driver_override pointer is NULL. Thus, printing "\n" instead of "(null)\n". Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02@gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 5039563e7c25 ("spi: Add driver_override SPI device attribute") Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260324005919.2408620-12-dakr@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-24spi: Use after free fixesMark Brown
Johan Hovold <johan@kernel.org> says: The SPI subsystem frees the controller and any subsystem allocated driver data as part of deregistration (unless the allocation is device managed). This series fixes the IMX driver that got this wrong and then converts it to use device managed allocation. Included are also a (preparatory) deregistration fix for the rockchip driver and related cleanups for the tegre20-slink and rockchip drivers that both take a controller reference during unbind.
2026-03-24spi: rockchip: switch to managed controller allocationJohan Hovold
Switch to device managed controller allocation to simplify error handling and to avoid having to take another reference during deregistration. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260324082326.901043-6-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-24spi: tegra20-slink: switch to managed controller allocationJohan Hovold
Switch to device managed controller allocation to simplify error handling and to avoid having to take another reference during deregistration. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260324082326.901043-5-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-24spi: imx: switch to managed controller allocationJohan Hovold
Switch to device managed controller allocation to simplify error handling and to avoid having to take another reference during deregistration. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260324082326.901043-4-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-24spi: rockchip: fix controller deregistrationJohan Hovold
Make sure to deregister the controller before freeing underlying resources like DMA channels during driver unbind. Fixes: 64e36824b32b ("spi/rockchip: add driver for Rockchip RK3xxx SoCs integrated SPI") Cc: stable@vger.kernel.org # 3.17 Cc: addy ke <addy.ke@rock-chips.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260324082326.901043-3-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-24spi: imx: fix use-after-free on unbindJohan Hovold
The SPI subsystem frees the controller and any subsystem allocated driver data as part of deregistration (unless the allocation is device managed). Take another reference before deregistering the controller so that the driver data is not freed until the driver is done with it. Fixes: 307c897db762 ("spi: spi-imx: replace struct spi_imx_data::bitbang by pointer to struct spi_controller") Cc: stable@vger.kernel.org # 5.19 Acked-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260324082326.901043-2-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-23spi: hisi-kunpeng cleanup and fixMark Brown
Pei Xiao <xiaopei01@kylinos.cn> says: I might have wasted your valuable time again. Please help check the two modifications. Thank you!
2026-03-23spi: hisi-kunpeng: Add timeout warning in FIFO flush functionPei Xiao
When flushing the FIFO, the driver waits for the busy flag to clear with a timeout. Change the loop condition to use pre-decrement (--limit) instead of post-decrement (limit--) so that warning message can show. Add a ratelimited warning message to log SPI busy timeout events, aiding in debugging. Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Link: https://patch.msgid.link/dad95ce42fb5677edfed32bc1f9b3e54df2cf8de.1773889292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-23spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifoPei Xiao
The hisi_spi_flush_fifo()'s inner while loop that lacks any timeout mechanism. Maybe the hardware never becomes empty, the loop will spin forever, causing the CPU to hang. Fix this by adding a inner_limit based on loops_per_jiffy. The inner loop now exits after approximately one jiffy if the FIFO remains non-empty, logs a ratelimited warning, and breaks out of the outer loop. Additionally, add a cpu_relax() inside the busy loop to improve power efficiency. Fixes: c770d8631e18 ("spi: Add HiSilicon SPI Controller Driver for Kunpeng SoCs") Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Link: https://patch.msgid.link/d834ce28172886bfaeb9c8ca00cfd9bf1c65d5a1.1773889292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-23spi: sunplus-sp7021: Simplify clock handling with devm_clk_get_enabled()Pei Xiao
Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for the clock. This removes the need for explicit clock enable/disable calls and the custom cleanup function, as the managed API automatically handles clock disabling on device removal or probe failure. Remove the now-unnecessary sp7021_spi_disable_unprepare() function and the devm_add_action_or_reset() call. Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Link: https://patch.msgid.link/fb0bc46107975cfff4eefa9ba96fe7545996ae52.1773885292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-23spi: stm32: Simplify clock handling with devm_clk_get_enabled()Pei Xiao
Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for the clock. This removes the need for explicit clock enable and disable calls, as the managed API automatically handles clock disabling on device removal or probe failure. Remove the now-unnecessary clk_disable_unprepare() calls from the probe error paths and the remove callback. Also simplify error handling by using dev_err_probe(). Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Acked-by: Alain Volmat <alain.volmat@foss.st.com> Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com> Link: https://patch.msgid.link/c8259f582596fd08541b94dce5dbb4cae513e295.1773885292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-23spi: sifive: Simplify clock handling with devm_clk_get_enabled()Pei Xiao
Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for the bus clock. This reduces boilerplate code and error handling, as the managed API automatically disables the clock when the device is removed or if probe fails. Remove the now-unnecessary clk_disable_unprepare() calls from the probe error path and the remove callback. Adjust the error handling to use the existing put_host label. Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Link: https://patch.msgid.link/73d0d8ecb4e1af5a558d6a7866c0f886d94fe3d1.1773885292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-23spi: bcmbca-hsspi: Simplify clock handling with devm_clk_get_enabled()Pei Xiao
Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for both the "hsspi" and "pll" clocks. This reduces boilerplate code and error handling, as the managed API automatically disables the clocks when the device is removed or if probe fails. Remove the now-unnecessary clk_disable_unprepare() calls from the probe error paths and the remove callback. Simplify the error handling by converting to direct returns with dev_err_probe() where appropriate. Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Link: https://patch.msgid.link/a3d07ed20d7bdc676fb10c9a73224f80e83b3232.1773885292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-23spi: bcm63xx-hsspi: Simplify clock handling with devm_clk_get_enabled()Pei Xiao
Replace devm_clk_get() followed by clk_prepare_enable() with devm_clk_get_enabled() for both the "hsspi" and "pll" clocks. This reduces boilerplate code and error handling, as the managed API automatically disables the clocks when the device is removed or if probe fails. Remove the now-unnecessary clk_disable_unprepare() calls from the probe error paths and the remove callback. Accordingly, adjust the error handling labels to direct returns where possible. Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Link: https://patch.msgid.link/3a187be6d9963645f01caebc1169e06f8804b7a6.1773885292.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-23spi: meson-spicc: Fix double-put in remove pathFelix Gu
meson_spicc_probe() registers the controller with devm_spi_register_controller(), so teardown already drops the controller reference via devm cleanup. Calling spi_controller_put() again in meson_spicc_remove() causes a double-put. Fixes: 8311ee2164c5 ("spi: meson-spicc: fix memory leak in meson_spicc_remove") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Reviewed-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260322-rockchip-v1-1-fac3f0c6dad8@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-23spi: pl022: update outdated references to pump_transfers()Kexin Sun
The pump_transfers tasklet was removed when the driver switched to the SPI core message processing loop in commit 9b2ef250b31d ("spi: spl022: switch to use default spi_transfer_one_message()"). The kdoc of pl022_interrupt_handler() still describes the old flow: scheduling the pump_transfers tasklet, calling giveback(), and flagging STATE_ERROR — none of which exist in the current code. Rewrite the kdoc to reflect the current paths, which flag errors via SPI_TRANS_FAIL_IO and call spi_finalize_current_transfer() directly. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun <kexinsun@smail.nju.edu.cn> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260321105940.8143-1-kexinsun@smail.nju.edu.cn Signed-off-by: Mark Brown <broonie@kernel.org>