mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: <shao.mingyin@zte.com.cn>
To: <broonie@kernel.org>, <linux-spi@vger.kernel.org>
Cc: <linux-kernel@vger.kernel.org>, <linux-riscv@lists.infradead.org>,
	<pjw@kernel.org>, <samuel.holland@sifive.com>,
	<william.zhang@broadcom.com>, <kursad.oney@broadcom.com>,
	<jonas.gorski@gmail.com>, <bcm-kernel-feedback-list@broadcom.com>,
	<anand.gore@broadcom.com>, <florian.fainelli@broadcom.com>,
	<rafal@milecki.pl>, <linux-arm-kernel@lists.infradead.org>,
	<sven@kernel.org>, <j@jannau.net>, <neal@gompa.dev>,
	<asahi@lists.linux.dev>, <ryan.wanner@microchip.com>,
	<nicolas.ferre@microchip.com>, <alexandre.belloni@bootlin.com>,
	<claudiu.beznea@tuxon.dev>
Subject: [PATCH 0/5] spi: fix division by zero with a zero transfer speed
Date: Fri, 6 Nov 2026 23:47:51 +0800 (CST)	[thread overview]
Message-ID: <20261106234751020Egf42VCVVlsSC_Msov4HO@zte.com.cn> (raw)

Five SPI controller drivers compute a clock divider from the transfer
speed without checking that it is non-zero.  A SPI device whose
max_speed_hz is zero (a DT node without spi-max-frequency, or a device
created through the spidev sysfs new_device interface without a speed)
therefore reaches the division with speed_hz == 0.  The SPI core clamps
such a device to the controller limit only when host->max_speed_hz is
set, and none of these five drivers sets it.

The series is organized by driver and is independent patch-by-patch;
each patch can be applied and reviewed on its own, and taking a subset
is fine:

  1/5 spi: sifive: fix division by zero in clock divisor calculation
  2/5 spi: bcm63xx-hsspi: fix division by zero for devices without a max speed
  3/5 spi: bcmbca-hsspi: fix division by zero for devices without a max speed
  4/5 spi: apple: fix division by zero in clock divisor calculation
  5/5 spi: atmel: fix division by zero when transfer speed is zero

All five clamp the divisor to 1 Hz, the same approach as the recent
spi-jcore fix.  The division does not trap on the SoCs these drivers run
on: depending on the architecture it produces a bogus divider, a zero
quotient or an undefined value, so the patches remove undefined
arithmetic rather than a crash.

Shao Mingyin (5):
  spi: sifive: fix division by zero in clock divisor calculation
  spi: bcm63xx-hsspi: fix division by zero for devices without a max speed
  spi: bcmbca-hsspi: fix division by zero for devices without a max speed
  spi: apple: fix division by zero in clock divisor calculation
  spi: atmel: fix division by zero when transfer speed is zero

 drivers/spi/spi-apple.c         | 6 +++++-
 drivers/spi/spi-atmel.c         | 3 ++-
 drivers/spi/spi-bcm63xx-hsspi.c | 3 +++
 drivers/spi/spi-bcmbca-hsspi.c  | 3 +++
 drivers/spi/spi-sifive.c        | 6 +++++-
 5 files changed, 18 insertions(+), 3 deletions(-)

---
base-commit: 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c

             reply	other threads:[~2026-11-06 15:47 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-06 15:47 shao.mingyin [this message]
2026-11-06 15:47 ` [PATCH 1/5] spi: sifive: fix division by zero in clock divisor calculation shao.mingyin
2026-11-06 15:47 ` [PATCH 2/5] spi: bcm63xx-hsspi: fix division by zero for devices without a max speed shao.mingyin
2026-11-06 15:48 ` [PATCH 3/5] spi: bcmbca-hsspi: " shao.mingyin
2026-11-06 15:48 ` [PATCH 4/5] spi: apple: fix division by zero in clock divisor calculation shao.mingyin
2026-11-06 15:48 ` [PATCH 5/5] spi: atmel: fix division by zero when transfer speed is zero shao.mingyin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261106234751020Egf42VCVVlsSC_Msov4HO@zte.com.cn \
    --to=shao.mingyin@zte.com.cn \
    --cc=alexandre.belloni@bootlin.com \
    --cc=anand.gore@broadcom.com \
    --cc=asahi@lists.linux.dev \
    --cc=bcm-kernel-feedback-list@broadcom.com \
    --cc=broonie@kernel.org \
    --cc=claudiu.beznea@tuxon.dev \
    --cc=florian.fainelli@broadcom.com \
    --cc=j@jannau.net \
    --cc=jonas.gorski@gmail.com \
    --cc=kursad.oney@broadcom.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-riscv@lists.infradead.org \
    --cc=linux-spi@vger.kernel.org \
    --cc=neal@gompa.dev \
    --cc=nicolas.ferre@microchip.com \
    --cc=pjw@kernel.org \
    --cc=rafal@milecki.pl \
    --cc=ryan.wanner@microchip.com \
    --cc=samuel.holland@sifive.com \
    --cc=sven@kernel.org \
    --cc=william.zhang@broadcom.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®