public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Johan Hovold <johan@kernel.org>
To: Mark Brown <broonie@kernel.org>
Cc: Frank Li <Frank.Li@nxp.com>,
	Sascha Hauer <s.hauer@pengutronix.de>,
	Heiko Stuebner <heiko@sntech.de>,
	Laxman Dewangan <ldewangan@nvidia.com>,
	Marc Kleine-Budde <mkl@pengutronix.de>,
	linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org,
	Johan Hovold <johan@kernel.org>
Subject: [PATCH v2 0/5] spi: imx: fix use-after-free on unbind
Date: Tue, 24 Mar 2026 09:23:21 +0100	[thread overview]
Message-ID: <20260324082326.901043-1-johan@kernel.org> (raw)

The SPI subsystem frees the controller and any subsystem allocated
driver data as part of deregistration (unless the allocation is device
managed).

This series fixes the IMX driver that got this wrong and then converts
it to use device managed allocation.

Included are also a (preparatory) deregistration fix for the rockchip
driver and related cleanups for the tegre20-slink and rockchip drivers
that both take a controller reference during unbind.

Johan


Changes in v2
 - add stable tag to rockchip fix
 - move rockchip fix before the cleanups


Johan Hovold (5):
  spi: imx: fix use-after-free on unbind
  spi: rockchip: fix controller deregistration
  spi: imx: switch to managed controller allocation
  spi: tegra20-slink: switch to managed controller allocation
  spi: rockchip: switch to managed controller allocation

 drivers/spi/spi-imx.c           | 41 +++++++++++----------------------
 drivers/spi/spi-rockchip.c      | 40 +++++++++++++-------------------
 drivers/spi/spi-tegra20-slink.c | 26 ++++++++-------------
 3 files changed, 40 insertions(+), 67 deletions(-)

-- 
2.52.0


             reply	other threads:[~2026-03-24  8:23 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-03-24  8:23 Johan Hovold [this message]
2026-03-24  8:23 ` [PATCH v2 1/5] spi: imx: fix use-after-free on unbind Johan Hovold
2026-03-24  8:23 ` [PATCH v2 2/5] spi: rockchip: fix controller deregistration Johan Hovold
2026-03-24  8:23 ` [PATCH v2 3/5] spi: imx: switch to managed controller allocation Johan Hovold
2026-03-24  8:23 ` [PATCH v2 4/5] spi: tegra20-slink: " Johan Hovold
2026-03-24  8:23 ` [PATCH v2 5/5] spi: rockchip: " Johan Hovold
2026-03-24 14:26 ` [PATCH v2 0/5] spi: imx: fix use-after-free on unbind Mark Brown

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260324082326.901043-1-johan@kernel.org \
    --to=johan@kernel.org \
    --cc=Frank.Li@nxp.com \
    --cc=broonie@kernel.org \
    --cc=heiko@sntech.de \
    --cc=ldewangan@nvidia.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-spi@vger.kernel.org \
    --cc=mkl@pengutronix.de \
    --cc=s.hauer@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox