]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one
authorBreno Leitao <leitao@debian.org>
Mon, 26 Jan 2026 17:50:28 +0000 (09:50 -0800)
committerMark Brown <broonie@kernel.org>
Fri, 30 Jan 2026 13:53:14 +0000 (13:53 +0000)
commitf5a4d7f5e32ba163cff893493ec1cbb0fd2fb0d5
treea140fae74b3c69886e8afb1af266e3e78b5213e7
parentef13ba357656451d6371940d8414e3e271df97e3
spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one

When the timeout handler processes a completed transfer and signals
completion, the transfer thread can immediately set up the next transfer
and assign curr_xfer to point to it.

If a delayed ISR from the previous transfer then runs, it checks if
(!tqspi->curr_xfer) (currently without the lock also -- to be fixed
soon) to detect stale interrupts, but this check passes because
curr_xfer now points to the new transfer. The ISR then incorrectly
processes the new transfer's context.

Protect the curr_xfer assignment with the spinlock to ensure the ISR
either sees NULL (and bails out) or sees the new value only after the
assignment is complete.

Fixes: 921fc1838fb0 ("spi: tegra210-quad: Add support for Tegra210 QSPI controller")
Signed-off-by: Breno Leitao <leitao@debian.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260126-tegra_xfer-v2-3-6d2115e4f387@debian.org
Signed-off-by: Mark Brown <broonie@kernel.org>
drivers/spi/spi-tegra210-quad.c