linux-stable.git/drivers/spi, branch v5.19.2

spi: tegra20-slink: fix UAF in tegra_slink_remove()

2022-08-17T13:14:17+00:00

[ Upstream commit 7e9984d183bb1e99e766c5c2b950ff21f7f7b6c0 ]

After calling spi_unregister_master(), the refcount of master will
be decrease to 0, and it will be freed in spi_controller_release(),
the device data also will be freed, so it will lead a UAF when using
'tspi'. To fix this, get the master before unregister and put it when
finish using it.

Fixes: 26c863418221 ("spi: tegra20-slink: Don't use resource-managed spi_register helper")
Signed-off-by: Yang Yingliang 
Link: https://lore.kernel.org/r/20220713094024.1508869-1-yangyingliang@huawei.com
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin

spi: Fix simplification of devm_spi_register_controller

2022-08-17T13:14:17+00:00

[ Upstream commit 43cc5a0afe4184a7fafe1eba32b5a11bb69c9ce0 ]

This reverts commit 59ebbe40fb51 ("spi: simplify
devm_spi_register_controller").

If devm_add_action() fails in devm_add_action_or_reset(),
devm_spi_unregister() will be called, it decreases the
refcount of 'ctlr->dev' to 0, then it will cause uaf in
the drivers that calling spi_put_controller() in error path.

Fixes: 59ebbe40fb51 ("spi: simplify devm_spi_register_controller")
Signed-off-by: Yang Yingliang 
Reviewed-by: Conor Dooley 
Link: https://lore.kernel.org/r/20220712135504.1055688-1-yangyingliang@huawei.com
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin

spi: dw: Fix IP-core versions macro

2022-08-17T13:14:17+00:00

[ Upstream commit 5d76b7509cb223e94ff73a672273e58f1957ac68 ]

Add the missing underscore in IP version macro to avoid compilation issue.
The macro is used for IP version comparison in the current patchset.

Fixes: 2cc8d9227bbb ("spi: dw: Introduce Synopsys IP-core versions interface")
Signed-off-by: Nandhini Srikandan 
Acked-by: Serge Semin 
Link: https://lore.kernel.org/r/20220713042223.1458-2-nandhini.srikandan@intel.com
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin

spi: Return deferred probe error when controller isn't yet available

2022-08-17T13:14:16+00:00

[ Upstream commit 9c22ec4ac27bcc5a54dd406da168f403327a5b55 ]

If the controller is not available, it might be in the future and
we would like to re-probe the peripheral again. For that purpose
return deferred probe.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215993
Fixes: 87e59b36e5e2 ("spi: Support selection of the index of the ACPI Spi Resource before alloc")
Signed-off-by: Andy Shevchenko 
Link: https://lore.kernel.org/r/20220709212956.25530-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin

spi: s3c64xx: constify fsd_spi_port_config

2022-08-17T13:14:10+00:00

[ Upstream commit a813c47d22b0a0c51567292bc198a39bdcdc3799 ]

All struct s3c64xx_spi_port_config should be const.

Fixes: 4ebb15a15799 ("spi: s3c64xx: Add spi port configuration for Tesla FSD SoC")
Signed-off-by: Krzysztof Kozlowski 
Link: https://lore.kernel.org/r/20220627094541.95166-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin

spi: spi-altera-dfl: Fix an error handling path

2022-08-17T13:14:07+00:00

[ Upstream commit 8e3ca32f46994e74b7f43c57731150b2aedb2630 ]

The spi_alloc_master() call is not undone in all error handling paths.
Moreover, there is no .remove function to release the allocated memory.

In order to fix both this issues, switch to devm_spi_alloc_master().

This allows further simplification of the probe.

Fixes: ba2fc167e944 ("spi: altera: Add DFL bus driver for Altera API Controller")
Signed-off-by: Christophe JAILLET 
Link: https://lore.kernel.org/r/0607bb59f4073f86abe5c585d35245aef0b045c6.1653805901.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin

spi: synquacer: Add missing clk_disable_unprepare()

2022-08-17T13:14:03+00:00

[ Upstream commit 917e43de2a56d9b82576f1cc94748261f1988458 ]

Add missing clk_disable_unprepare() in synquacer_spi_resume().

Reported-by: Hulk Robot 
Signed-off-by: Guo Mengqi 
Link: https://lore.kernel.org/r/20220624005614.49434-1-guomengqi3@huawei.com
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin

spi: spi-rspi: Fix PIO fallback on RZ platforms

2022-07-21T16:21:07+00:00

RSPI IP on RZ/{A, G2L} SoC's has the same signal for both interrupt
and DMA transfer request. Setting DMARS register for DMA transfer
makes the signal to work as a DMA transfer request signal and
subsequent interrupt requests to the interrupt controller
are masked.

PIO fallback does not work as interrupt signal is disabled.

This patch fixes this issue by re-enabling the interrupts by
calling dmaengine_synchronize().

Signed-off-by: Biju Das 
Reviewed-by: Geert Uytterhoeven 
Link: https://lore.kernel.org/r/20220721143449.879257-1-biju.das.jz@bp.renesas.com
Signed-off-by: Mark Brown

spi: spi-cadence: Fix SPI NO Slave Select macro definition

2022-07-20T17:45:21+00:00

Fix SPI NO Slave Select macro definition, when all the SPI CS bits
are high which means no slave is selected.

Fixes: 21b511ddee09 ("spi: spi-cadence: Fix SPI CS gets toggling sporadically")
Signed-off-by: Sai Krishna Potthuri 
Signed-off-by: Amit Kumar Mahapatra 
Link: https://lore.kernel.org/r/20220713164529.28444-1-amit.kumar-mahapatra@xilinx.com
Signed-off-by: Mark Brown

spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers

2022-07-20T13:03:40+00:00

In case a IRQ based transfer times out the bcm2835_spi_handle_err()
function is called. Since commit 1513ceee70f2 ("spi: bcm2835: Drop
dma_pending flag") the TX and RX DMA transfers are unconditionally
canceled, leading to NULL pointer derefs if ctlr->dma_tx or
ctlr->dma_rx are not set.

Fix the NULL pointer deref by checking that ctlr->dma_tx and
ctlr->dma_rx are valid pointers before accessing them.

Fixes: 1513ceee70f2 ("spi: bcm2835: Drop dma_pending flag")
Cc: Lukas Wunner 
Signed-off-by: Marc Kleine-Budde 
Link: https://lore.kernel.org/r/20220719072234.2782764-1-mkl@pengutronix.de
Signed-off-by: Mark Brown