CVE-2026-90410: spi: davinci: switch to managed controller allocation
In the Linux kernel, the following vulnerability has been resolved:
spi: davinci: switch to managed controller allocation
The controller is allocated with the non-managed spiallochost() while the interrupt is registered with devmrequestthreadedirq(). During removal, spibitbangstop() only unregisters the controller; the subsequent spicontrollerput() then frees the controller together with its embedded davincispi devdata, which is the IRQ handler's devid. The devmrequestthreadedirq() release action (freeirq()), which drains the handler, does not run until after .remove() returns. A late or latched interrupt can therefore reach davincispiirq() and dereference already-freed memory.
Switch to devmspiallochost() so that the devres LIFO order releases the controller only after freeirq() has drained the handler, and drop the now-redundant spicontrollerput() from .remove(). The probe error path is simplified to direct returns.
The clock is acquired with devmclkgetenabled(), which is registered after the IRQ and thus released before it by the devres LIFO order. Drain the interrupt explicitly with devmfreeirq() before disabling the controller so that a late interrupt cannot access the registers of a clock-gated controller.
This issue was found by an in-house static analysis tool.
Affected Software
Event History
Frequently Asked Questions
When does the use-after-free occur?
It occurs during device removal, after the SPI controller and its embedded driver data have been freed but before the managed IRQ release action has drained the interrupt handler. A late or already-latched interrupt can then invoke the handler with the freed driver-data pointer.
What systems are exposed to this condition?
Systems using the DaVinci SPI controller driver are exposed during removal of that controller. The issue depends on an interrupt arriving in the removal window; the provided information does not identify any default configuration or specific affected kernel versions.
What does the fix change?
The fix uses managed SPI controller allocation so that IRQ cleanup occurs before the controller is released, and explicitly drains the IRQ before the controller is disabled. It also removes the redundant controller put operation from the remove path.