From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A1DE1E25F9 for ; Thu, 30 Apr 2026 13:53:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777557186; cv=none; b=UOMX/0BDH/d2wmDwW/yLTTQ2v1SM4MP7x2tYvjPsR1d3KdahyOtqGweLOBIBS8d4vU8OEhemT05gnLkiK/0a1Oy9ck3hOCFog3kx9p/yyXfTrZedDbjB/HM/uZAoYuuLAi1BQHNvsOh9TvGR/wKQ4fopn0nCALH3GGeeOm1oFAc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777557186; c=relaxed/simple; bh=pbPI/+qcSciJKTD2ISvLx4g89hkxdVvuxaCIE8u8Kl8=; h=Subject:To:Cc:From:Date:Message-ID:MIME-Version:Content-Type; b=NbsLnd3nfDKJf/NJJBa6pTFzy0HtEikPFuInP3EVNcSj8o9+mkAdsK6YzWtegKoalBwLHDm/sTLaU4RoXz0A2+eb+HiEGImhIbMaIizD9WOWL9WuNNZKgPHeLLiZYb0iDIBDWNGkUu32C8//jnPvin8BfoaJUl1mFIGV8aacblM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vXaWS0/B; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="vXaWS0/B" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C5606C2BCB3; Thu, 30 Apr 2026 13:53:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1777557186; bh=pbPI/+qcSciJKTD2ISvLx4g89hkxdVvuxaCIE8u8Kl8=; h=Subject:To:Cc:From:Date:From; b=vXaWS0/Bc+PDyFmbMeVEZENct1NBUYe0P1v6tO9ULQA55rU6wdIfXnBB3M6/u45rQ Frv6mCqaoiHkqdnG2ORkT+QQvyXsmQ8PO4J8EVbAGjPdpZnR2M+GljmErU+BsU/aoC oEZXKzOhrn5N+mO+N0wno4r3wvBmHBQO4y5gVOeg= Subject: FAILED: patch "[PATCH] spi: imx: fix use-after-free on unbind" failed to apply to 5.10-stable tree To: johan@kernel.org,broonie@kernel.org,mkl@pengutronix.de Cc: From: Date: Thu, 30 Apr 2026 15:52:53 +0200 Message-ID: <2026043053-washer-headstone-57d6@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 1c78c2002380a1fe31bfb01a3d5f29809e55a096 # git commit -s git send-email --to '' --in-reply-to '2026043053-washer-headstone-57d6@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 1c78c2002380a1fe31bfb01a3d5f29809e55a096 Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Tue, 24 Mar 2026 09:23:22 +0100 Subject: [PATCH] spi: imx: fix use-after-free on unbind The SPI subsystem frees the controller and any subsystem allocated driver data as part of deregistration (unless the allocation is device managed). Take another reference before deregistering the controller so that the driver data is not freed until the driver is done with it. Fixes: 307c897db762 ("spi: spi-imx: replace struct spi_imx_data::bitbang by pointer to struct spi_controller") Cc: stable@vger.kernel.org # 5.19 Acked-by: Marc Kleine-Budde Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260324082326.901043-2-johan@kernel.org Signed-off-by: Mark Brown diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c index 64c6c09e1e7b..a8d90c86a8a1 100644 --- a/drivers/spi/spi-imx.c +++ b/drivers/spi/spi-imx.c @@ -2401,6 +2401,8 @@ static void spi_imx_remove(struct platform_device *pdev) struct spi_imx_data *spi_imx = spi_controller_get_devdata(controller); int ret; + spi_controller_get(controller); + spi_unregister_controller(controller); ret = pm_runtime_get_sync(spi_imx->dev); @@ -2414,6 +2416,8 @@ static void spi_imx_remove(struct platform_device *pdev) pm_runtime_disable(spi_imx->dev); spi_imx_sdma_exit(spi_imx); + + spi_controller_put(controller); } static int spi_imx_runtime_resume(struct device *dev)