git/linux-net
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/ synced 2026-04-03 23:37:40 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
linux-net/drivers/spi
History
Marc Kleine-Budde b341c1176f spi: spi-fsl-lpspi: fix teardown order issue (UAF) 
There is a teardown order issue in the driver. The SPI controller is
registered using devm_spi_register_controller(), which delays
unregistration of the SPI controller until after the fsl_lpspi_remove()
function returns.

As the fsl_lpspi_remove() function synchronously tears down the DMA
channels, a running SPI transfer triggers the following NULL pointer
dereference due to use after free:

| fsl_lpspi 42550000.spi: I/O Error in DMA RX
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[...]
| Call trace:
|  fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]
|  fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]
|  spi_transfer_one_message+0x49c/0x7c8
|  __spi_pump_transfer_message+0x120/0x420
|  __spi_sync+0x2c4/0x520
|  spi_sync+0x34/0x60
|  spidev_message+0x20c/0x378 [spidev]
|  spidev_ioctl+0x398/0x750 [spidev]
[...]

Switch from devm_spi_register_controller() to spi_register_controller() in
fsl_lpspi_probe() and add the corresponding spi_unregister_controller() in
fsl_lpspi_remove().

Fixes: 5314987de5 ("spi: imx: add lpspi bus driver")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Link: https://patch.msgid.link/20260319-spi-fsl-lpspi-fixes-v1-1-b433e435b2d8@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-26 12:27:42 +00:00
..
atmel-quadspi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
internals.h
…
Kconfig
spi: dw: Remove not-going-to-be-supported code for Baikal SoC
2026-01-29 11:54:47 +00:00
Makefile
spi: dw: Remove not-going-to-be-supported code for Baikal SoC
2026-01-29 11:54:47 +00:00
spi-airoha-snfi.c
spi: Drop duplicate device_set_node() call
2026-01-19 14:42:54 +00:00
spi-altera-core.c
…
spi-altera-dfl.c
…
spi-altera-platform.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-amd-pci.c
spi: spi_amd: Remove the use of dev_err_probe()
2025-08-19 13:05:58 +01:00
spi-amd.c
spi: spi_amd: Remove the use of dev_err_probe()
2025-08-19 13:05:58 +01:00
spi-amd.h
spi: spi_amd: Add PCI-based driver for AMD HID2 SPI controller
2025-04-06 23:26:10 +01:00
spi-amlogic-spifc-a1.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-amlogic-spifc-a4.c
spi: amlogic: spifc-a4: Remove redundant clock cleanup
2026-03-15 23:57:53 +00:00
spi-amlogic-spisg.c
spi: amlogic-spisg: Fix memory leak in aml_spisg_probe()
2026-03-15 23:58:47 +00:00
spi-apple.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-ar934x.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-armada-3700.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-aspeed-smc.c
spi: aspeed: Improve handling of shared SPI
2026-01-28 11:22:06 +00:00
spi-at91-usart.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-atcspi200.c
spi: atcspi200: Handle invalid buswidth and fix compiler warning
2026-03-11 19:08:43 +00:00
spi-ath79.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-atmel.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-au1550.c
…
spi-axi-spi-engine.c
Convert 'alloc_flex' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-axiado.c
spi: axiado: Fix double-free in ax_spi_probe()
2026-03-16 00:28:54 +00:00
spi-axiado.h
spi: axiado: Add driver for Axiado SPI DB controller
2026-01-09 13:21:55 +00:00
spi-bcm63xx-hsspi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-bcm63xx.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-bcm2835.c
Convert 'alloc_flex' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-bcm2835aux.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-bcm-qspi.c
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
spi-bcm-qspi.h
…
spi-bcmbca-hsspi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-bitbang-txrx.h
…
spi-bitbang.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-brcmstb-qspi.c
…
spi-butterfly.c
…
spi-cadence-quadspi.c
spi: cadence-qspi: Fix requesting of APB and AHB clocks on JH7110
2026-03-10 14:32:38 +00:00
spi-cadence-xspi.c
spi: cadence-xspi: support suspend/resume
2026-01-27 12:46:29 +00:00
spi-cadence.c
spi: aspeed: Improve handling of shared SPI
2026-01-28 11:22:06 +00:00
spi-cavium-octeon.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-cavium-thunderx.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-cavium.c
…
spi-cavium.h
spi: cavium: Follow renaming of SPI "master" to "controller"
2024-02-08 11:54:50 +00:00
spi-ch341.c
spi: ch341: fix out-of-bounds memory access in ch341_transfer_one
2025-11-28 11:48:08 +00:00
spi-clps711x.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-coldfire-qspi.c
…
spi-cs42l43.c
spi: Propagate default fwnode to the SPI controller device
2026-01-19 14:42:51 +00:00
spi-davinci.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-dln2.c
spi: Drop duplicate device_set_node() call
2026-01-19 14:42:54 +00:00
spi-dw-core.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-dw-dma.c
spi: spi-dw-dma: fix print error log when wait finish transaction
2026-03-02 22:33:32 +00:00
spi-dw-mmio.c
spi: dw: Remove duplicate error message
2026-01-28 11:58:11 +00:00
spi-dw-pci.c
spi: dw: rename the spi controller to ctlr
2025-10-13 11:27:35 +01:00
spi-dw.h
spi: dw: rename the spi controller to ctlr
2025-10-13 11:27:35 +01:00
spi-ep93xx.c
spi: Drop duplicate device_set_node() call
2026-01-19 14:42:54 +00:00
spi-falcon.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-fsi.c
Merge tag 'char-misc-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2026-02-17 09:11:04 -08:00
spi-fsl-cpm.c
…
spi-fsl-cpm.h
…
spi-fsl-dspi.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-fsl-espi.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-fsl-lib.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-fsl-lib.h
…
spi-fsl-lpspi.c
spi: spi-fsl-lpspi: fix teardown order issue (UAF)
2026-03-26 12:27:42 +00:00
spi-fsl-qspi.c
spi: fsl-qspi: support the SpacemiT K1 SoC
2025-11-06 16:57:36 +00:00
spi-fsl-spi.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-fsl-spi.h
…
spi-geni-qcom.c
spi: geni-qcom: Check DMA interrupts early in ISR
2026-03-17 17:07:47 +00:00
spi-gpio.c
spi: Drop duplicate device_set_node() call
2026-01-19 14:42:54 +00:00
spi-gxp.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-hisi-kunpeng.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-hisi-sfc-v3xx.c
…
spi-img-spfi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-imx.c
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
spi-ingenic.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-intel-pci.c
spi: intel-pci: Add support for Nova Lake mobile SPI flash
2026-03-11 00:07:54 +00:00
spi-intel-platform.c
spi: intel: Improve resource mapping
2025-04-24 12:56:59 +01:00
spi-intel.c
spi: intel: Add support for 128M component density
2025-10-20 16:15:29 +01:00
spi-intel.h
spi: intel: Improve resource mapping
2025-04-24 12:56:59 +01:00
spi-iproc-qspi.c
…
spi-jcore.c
…
spi-kspi2.c
…
spi-lantiq-ssc.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-ljca.c
spi: Drop duplicate device_set_node() call
2026-01-19 14:42:54 +00:00
spi-lm70llp.c
…
spi-loongson-core.c
spi: Drop duplicate device_set_node() call
2026-01-19 14:42:54 +00:00
spi-loongson-pci.c
…
spi-loongson-plat.c
…
spi-loongson.h
…
spi-loopback-test.c
spi: loopback-test: Don't use %pK through printk
2025-08-12 12:06:13 +01:00
spi-lp8841-rtc.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-mem.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-meson-spicc.c
spi: meson-spicc: Fix double-put in remove path
2026-03-23 18:32:05 +00:00
spi-meson-spifc.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-microchip-core-qspi.c
support for Amlogic SPI Flash Controller IP
2025-09-12 00:54:56 +01:00
spi-microchip-core-spi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-mpc52xx-psc.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-mpc52xx.c
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
spi-mpc512x-psc.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-mpfs.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-mt65xx.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-mt7621.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-mtk-nor.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-mtk-snfi.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-mux.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-mxic.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-mxs.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-npcm-fiu.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-npcm-pspi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-nxp-fspi.c
spi: Drop duplicate device_set_node() call
2026-01-19 14:42:54 +00:00
spi-nxp-xspi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-oc-tiny.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-offload-trigger-adi-util-sigma-delta.c
spi: offload trigger: adi-util-sigma-delta: clean up imports
2025-08-18 13:13:57 +01:00
spi-offload-trigger-pwm.c
spi: offload: Add offset parameter
2025-10-13 11:27:52 +01:00
spi-offload.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-omap2-mcspi.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-omap-uwire.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-orion.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-pci1xxxx.c
spi: spi-pci1xxxx: enable concurrent DMA read/write across SPI transfers
2025-06-30 12:15:45 +01:00
spi-pic32-sqi.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-pic32.c
…
spi-pl022.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-ppc4xx.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-pxa2xx-dma.c
…
spi-pxa2xx-pci.c
…
spi-pxa2xx-platform.c
…
spi-pxa2xx.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-pxa2xx.h
…
spi-qcom-qspi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-qpic-snand.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-qup.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-rb4xx.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-realtek-rtl-snand.c
spi: Drop duplicate device_set_node() call
2026-01-19 14:42:54 +00:00
spi-realtek-rtl.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-rockchip-sfc.c
spi: rockchip-sfc: Fix double-free in remove() callback
2026-03-09 19:10:21 +00:00
spi-rockchip.c
spi: Make SPI core to take care of fwnode
2026-01-20 17:58:31 +00:00
spi-rpc-if.c
spi: rpc-if: Add resume support for RZ/G3E
2025-09-22 09:21:18 +01:00
spi-rspi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-rzv2h-rspi.c
spi: Drop duplicate device_set_node() call
2026-01-19 14:42:54 +00:00
spi-rzv2m-csi.c
spi: Drop duplicate device_set_node() call
2026-01-19 14:42:54 +00:00
spi-s3c64xx.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-sc18is602.c
spi: Drop duplicate device_set_node() call
2026-01-19 14:42:54 +00:00
spi-sg2044-nor.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-sh-hspi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-sh-msiof.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-sh-sci.c
…
spi-sh.c
…
spi-sifive.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-slave-mt27xx.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-slave-system-control.c
…
spi-slave-time.c
…
spi-sn-f-ospi.c
spi: sn-f-ospi: Use devm_mutex_init() to simplify code
2026-03-23 14:51:59 +00:00
spi-sprd-adi.c
spi: aspeed: Improve handling of shared SPI
2026-01-28 11:22:06 +00:00
spi-sprd.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-st-ssc4.c
spi: st: remove __maybe_unused for suspend/resume
2026-01-06 12:23:36 +00:00
spi-stm32-ospi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-stm32-qspi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-stm32.c
spi: stm32: fix missing pointer assignment in case of dma chaining
2026-02-26 23:16:12 +00:00
spi-sun4i.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-sun6i.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-sunplus-sp7021.c
spi: Drop duplicate device_set_node() call
2026-01-19 14:42:54 +00:00
spi-synquacer.c
spi: Drop duplicate fwnode assignment
2026-01-19 14:42:53 +00:00
spi-tegra20-sflash.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-tegra20-slink.c
Merge tag 'spi-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
2026-02-11 09:43:43 -08:00
spi-tegra114.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-tegra210-quad.c
Merge tag 'spi-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
2026-02-11 09:43:43 -08:00
spi-test.h
…
spi-ti-qspi.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-tle62x0.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-topcliff-pch.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
spi-uniphier.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-virtio.c
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
spi-wpcm-fiu.c
spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()
2026-02-13 17:08:24 +00:00
spi-xcomm.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-xilinx.c
spi: xilinx: use device property accessors.
2026-02-03 21:06:18 +00:00
spi-xlp.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-xtensa-xtfpga.c
spi: Drop duplicate of_node assignment
2026-01-19 14:42:52 +00:00
spi-zynq-qspi.c
…
spi-zynqmp-gqspi.c
spi: Remove redundant pm_runtime_mark_last_busy() calls
2025-07-05 00:50:32 +01:00
spi.c
spi: fix use-after-free on managed registration failure
2026-03-26 10:45:28 +00:00
spidev.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00