Unverified Commit ef13ba35 authored by Breno Leitao's avatar Breno Leitao Committed by Mark Brown
Browse files

spi: tegra210-quad: Move curr_xfer read inside spinlock 



Move the assignment of the transfer pointer from curr_xfer inside the
spinlock critical section in both handle_cpu_based_xfer() and
handle_dma_based_xfer().

Previously, curr_xfer was read before acquiring the lock, creating a
window where the timeout path could clear curr_xfer between reading it
and using it. By moving the read inside the lock, the handlers are
guaranteed to see a consistent value that cannot be modified by the
timeout path.

Fixes: 921fc183 ("spi: tegra210-quad: Add support for Tegra210 QSPI controller")
Signed-off-by: default avatarBreno Leitao <leitao@debian.org>
Acked-by: default avatarThierry Reding <treding@nvidia.com>
Tested-by: default avatarJon Hunter <jonathanh@nvidia.com>
Acked-by: default avatarJon Hunter <jonathanh@nvidia.com>
Link: https://patch.msgid.link/20260126-tegra_xfer-v2-2-6d2115e4f387@debian.org


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent aabd8ea0

drivers/spi/spi-tegra210-quad.c

+4 −2
Original line number Diff line number Diff line
@@ -1440,10 +1440,11 @@ static int tegra_qspi_transfer_one_message(struct spi_controller *host, 


static irqreturn_t handle_cpu_based_xfer(struct tegra_qspi *tqspi)

{

	struct spi_transfer *t = tqspi->curr_xfer;

	struct spi_transfer *t;

	unsigned long flags;



	spin_lock_irqsave(&tqspi->lock, flags);

	t = tqspi->curr_xfer;



	if (tqspi->tx_status ||  tqspi->rx_status) {

		tegra_qspi_handle_error(tqspi);
@@ -1474,7 +1475,7 @@ static irqreturn_t handle_cpu_based_xfer(struct tegra_qspi *tqspi) 


static irqreturn_t handle_dma_based_xfer(struct tegra_qspi *tqspi)

{

	struct spi_transfer *t = tqspi->curr_xfer;

	struct spi_transfer *t;

	unsigned int total_fifo_words;

	unsigned long flags;

	long wait_status;
@@ -1513,6 +1514,7 @@ static irqreturn_t handle_dma_based_xfer(struct tegra_qspi *tqspi) 
	}



	spin_lock_irqsave(&tqspi->lock, flags);

	t = tqspi->curr_xfer;



	if (num_errors) {

		tegra_qspi_dma_unmap_xfer(tqspi, t);