Unverified Commit f5a4d7f5 authored by Breno Leitao's avatar Breno Leitao Committed by Mark Brown
Browse files

spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one 



When the timeout handler processes a completed transfer and signals
completion, the transfer thread can immediately set up the next transfer
and assign curr_xfer to point to it.

If a delayed ISR from the previous transfer then runs, it checks if
(!tqspi->curr_xfer) (currently without the lock also -- to be fixed
soon) to detect stale interrupts, but this check passes because
curr_xfer now points to the new transfer. The ISR then incorrectly
processes the new transfer's context.

Protect the curr_xfer assignment with the spinlock to ensure the ISR
either sees NULL (and bails out) or sees the new value only after the
assignment is complete.

Fixes: 921fc183 ("spi: tegra210-quad: Add support for Tegra210 QSPI controller")
Signed-off-by: default avatarBreno Leitao <leitao@debian.org>
Tested-by: default avatarJon Hunter <jonathanh@nvidia.com>
Acked-by: default avatarJon Hunter <jonathanh@nvidia.com>
Acked-by: default avatarThierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260126-tegra_xfer-v2-3-6d2115e4f387@debian.org


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent ef13ba35

drivers/spi/spi-tegra210-quad.c

+3 −0
Original line number Diff line number Diff line
@@ -839,6 +839,7 @@ static u32 tegra_qspi_setup_transfer_one(struct spi_device *spi, struct spi_tran 
	u32 command1, command2, speed = t->speed_hz;

	u8 bits_per_word = t->bits_per_word;

	u32 tx_tap = 0, rx_tap = 0;

	unsigned long flags;

	int req_mode;



	if (!has_acpi_companion(tqspi->dev) && speed != tqspi->cur_speed) {
@@ -846,10 +847,12 @@ static u32 tegra_qspi_setup_transfer_one(struct spi_device *spi, struct spi_tran 
		tqspi->cur_speed = speed;

	}



	spin_lock_irqsave(&tqspi->lock, flags);

	tqspi->cur_pos = 0;

	tqspi->cur_rx_pos = 0;

	tqspi->cur_tx_pos = 0;

	tqspi->curr_xfer = t;

	spin_unlock_irqrestore(&tqspi->lock, flags);



	if (is_first_of_msg) {

		tegra_qspi_mask_clear_irq(tqspi);