[PATCH v2] spi: dw: fix race between transfer IRQ handler and timeout handler

[PATCH v2] spi: dw: fix race between transfer IRQ handler and timeout handler

[Peng Yang]

On SMP systems, dw_spi_handle_err() can be called from the SPI core
kthread while the IRQ handler is still accessing the FIFO on another
CPU. Resetting the chip via dw_spi_reset_chip() during an active FIFO
read/write causes a bus error.

Fix this by calling disable_irq() before the chip reset, which masks
the IRQ and waits for any in-flight handler to complete via
synchronize_irq(). This ensures no handler is accessing the FIFO when
the reset occurs.

Fixes: 0b6bfad4cee4 ("spi: spi-dw: Remove extraneous locking")
Signed-off-by: Peng Yang <pyangyyd@amazon.com>
Suggested-by: Jonathan Chocron <jonnyc@amazon.com>
---
v1 -> v2:
- Replace spinlock with disable_irq()/enable_irq() as suggested by
  Jonathan Chocron. This avoids touching the IRQ handler hot path
  entirely.

v1: https://lore.kernel.org/linux-spi/20260522095727.18307-1-pyangyyd@amazon.com/

 drivers/spi/spi-dw-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-dw-core.c b/drivers/spi/spi-dw-core.c
--- a/drivers/spi/spi-dw-core.c
+++ b/drivers/spi/spi-dw-core.c
@@ -468,10 +468,12 @@ static inline void dw_spi_abort(struct spi_controller *ctlr)
 {
 	struct dw_spi *dws = spi_controller_get_devdata(ctlr);
 
 	if (dws->dma_mapped)
 		dws->dma_ops->dma_stop(dws);
 
+	disable_irq(dws->irq);
 	dw_spi_reset_chip(dws);
+	enable_irq(dws->irq);
 }
 
 static void dw_spi_handle_err(struct spi_controller *ctlr,
-- 
2.40.1

Re: [PATCH v2] spi: dw: fix race between transfer IRQ handler and timeout handler

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 388 bytes --]

On Tue, Jun 09, 2026 at 06:29:55PM +0800, Peng Yang wrote:

> Fixes: 0b6bfad4cee4 ("spi: spi-dw: Remove extraneous locking")
> Signed-off-by: Peng Yang <pyangyyd@amazon.com>
> Suggested-by: Jonathan Chocron <jonnyc@amazon.com>

Your signoff doesn't match your email address here,
please see Documentation/process/submitting-patches.rst for details
on what this is and why it's important.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]