[PATCH] spi: uniphier: Fix completion initialization order before devm_request_irq()

[PATCH] spi: uniphier: Fix completion initialization order before devm_request_irq()

[Kunihiko Hayashi]

The driver calls devm_request_irq() before initializing the completion
used by the interrupt handler. Because the interrupt may occur immediately
after devm_request_irq(), the handler may execute before init_completion().

This may result in calling complete() on an uninitialized completion,
causing undefined behavior. This has been observed with KASAN.

Fix this by initializing the completion before registering the IRQ.

Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Fixes: 5ba155a4d4cc ("spi: add SPI controller driver for UniPhier SoC")
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
---
 drivers/spi/spi-uniphier.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-uniphier.c b/drivers/spi/spi-uniphier.c
index 9e1d364a6198..6d3463fe0e3c 100644
--- a/drivers/spi/spi-uniphier.c
+++ b/drivers/spi/spi-uniphier.c
@@ -659,6 +659,8 @@ static int uniphier_spi_probe(struct platform_device *pdev)
 	priv->host = host;
 	priv->is_save_param = false;
 
+	init_completion(&priv->xfer_done);
+
 	priv->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
 	if (IS_ERR(priv->base)) {
 		ret = PTR_ERR(priv->base);
@@ -690,8 +692,6 @@ static int uniphier_spi_probe(struct platform_device *pdev)
 		goto out_disable_clk;
 	}
 
-	init_completion(&priv->xfer_done);
-
 	clk_rate = clk_get_rate(priv->clk);
 
 	host->max_speed_hz = DIV_ROUND_UP(clk_rate, SSI_MIN_CLK_DIVIDER);
-- 
2.34.1

Re: [PATCH] spi: uniphier: Fix completion initialization order before devm_request_irq()

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 361 bytes --]

On Thu, Jun 11, 2026 at 08:31:37PM +0900, Kunihiko Hayashi wrote:
> The driver calls devm_request_irq() before initializing the completion
> used by the interrupt handler. Because the interrupt may occur immediately
> after devm_request_irq(), the handler may execute before init_completion().

This doesn't apply against current code, please check and resend.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH] spi: uniphier: Fix completion initialization order before devm_request_irq()

[Kunihiko Hayashi]

Hi Mark,

On 2026/06/11 23:09, Mark Brown wrote:
> On Thu, Jun 11, 2026 at 08:31:37PM +0900, Kunihiko Hayashi wrote:
>> The driver calls devm_request_irq() before initializing the completion
>> used by the interrupt handler. Because the interrupt may occur immediately
>> after devm_request_irq(), the handler may execute before init_completion().
> 
> This doesn't apply against current code, please check and resend.

That seems a bit strange. I applied this patch to v7.0 and linux-next successfully.
Which tree did you apply to and fail?

Thank you,

---
Best Regards
Kunihiko Hayashi

Re: [PATCH] spi: uniphier: Fix completion initialization order before devm_request_irq()

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 371 bytes --]

On Fri, Jun 12, 2026 at 05:17:49PM +0900, Kunihiko Hayashi wrote:
> On 2026/06/11 23:09, Mark Brown wrote:

> > This doesn't apply against current code, please check and resend.

> That seems a bit strange. I applied this patch to v7.0 and linux-next successfully.
> Which tree did you apply to and fail?

It applies to none of spi/for-7.1, spi/for-7.2 nor spi/for-next.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]