Re: [PATCH 6.12.y] spi: tegra210-quad: Protect curr_xfer check in IRQ handler

[Breno Leitao]

On Tue, Mar 24, 2026 at 02:08:32PM +0800, Jianqiang kang wrote:
> From: Breno Leitao <leitao@xxxxxxxxxx>
> 
> [ Upstream commit edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e ]
> 
> Now that all other accesses to curr_xfer are done under the lock,
> protect the curr_xfer NULL check in tegra_qspi_isr_thread() with the
> spinlock. Without this protection, the following race can occur:
> 
>   CPU0 (ISR thread)              CPU1 (timeout path)
>   ----------------               -------------------
>   if (!tqspi->curr_xfer)
>     // sees non-NULL
>                                  spin_lock()
>                                  tqspi->curr_xfer = NULL
>                                  spin_unlock()
>   handle_*_xfer()
>     spin_lock()
>     t = tqspi->curr_xfer  // NULL!
>     ... t->len ...        // NULL dereference!
> 
> With this patch, all curr_xfer accesses are now properly synchronized.
> 
> Although all accesses to curr_xfer are done under the lock, in
> tegra_qspi_isr_thread() it checks for NULL, releases the lock and
> reacquires it later in handle_cpu_based_xfer()/handle_dma_based_xfer().
> There is a potential for an update in between, which could cause a NULL
> pointer dereference.
> 
> To handle this, add a NULL check inside the handlers after acquiring
> the lock. This ensures that if the timeout path has already cleared
> curr_xfer, the handler will safely return without dereferencing the
> NULL pointer.
> 
> Fixes: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling")
> Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
> Tested-by: Jon Hunter <jonathanh@xxxxxxxxxx>
> Acked-by: Jon Hunter <jonathanh@xxxxxxxxxx>
> Acked-by: Thierry Reding <treding@xxxxxxxxxx>
> Link: https://patch.msgid.link/20260126-tegra_xfer-v2-6-6d2115e4f387@xxxxxxxxxx
> Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
> [ Minor conflict resolved. ]
> Signed-off-by: Jianqiang kang <jianqkang@xxxxxxx>

Acked-by: Breno Leitao <leitao@xxxxxxxxxx>