 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3AAA13790B
	for <stable@vger.kernel.org>; Thu, 23 Oct 2025 21:47:48 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.43.8.18
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1761256073; cv=none; b=Ha2TDGmQXaZsVpHBbzsagbuflHqIECeXNuM+aDmdVnlbovSY9lzbauJ8saWDXOMEbRrLWowy97rhg/NIxYE79NF0btj8ulpdftPyr6WwwWQR0ej5Lx+t3724FHeui3NhlX1HKkFOecC00ruF3WGSzozGtX5L+fSW9a5whEPpweY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1761256073; c=relaxed/simple;
	bh=mJpOqNCTvzTBHwdN370dGYMUzPzecvsrw4ANCkvgjtQ=;
	h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=bQhwUZkVgyc9ertR4WupGxG5bINcdtqTnECrnoU+mzYv1lNyWThZz3gZ3Y20NFC5PqpAce+dPWjQUwsji00jV25v2bumd2G44EDnuR/7UXAjXKdcCRIl85eXVNPv4SpC0Yy8PIu4zHaUC3gyMAQWqshO2tTU+e4pY/ddLDbfKLY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=altlinux.org; spf=pass smtp.mailfrom=altlinux.org; arc=none smtp.client-ip=193.43.8.18
Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=altlinux.org
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=altlinux.org
Received: from altlinux.ipa.basealt.ru (unknown [178.76.204.78])
	(Authenticated sender: kovalevvv)
	by air.basealt.ru (Postfix) with ESMTPSA id 5891623372;
	Fri, 24 Oct 2025 00:47:40 +0300 (MSK)
From: Vasiliy Kovalev <kovalev@altlinux.org>
To: stable@vger.kernel.org
Cc: Mark Brown <broonie@kernel.org>,
	Heiko Stuebner <heiko@sntech.de>,
	lvc-project@linuxtesting.org,
	kovalev@altlinux.org
Subject: [PATCH 6.1.y] spi-rockchip: Fix register out of bounds access
Date: Fri, 24 Oct 2025 00:47:39 +0300
Message-Id: <20251023214739.247289-1-kovalev@altlinux.org>
X-Mailer: git-send-email 2.33.8
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.5 (/)
X-Spam-Report: Spam detection software, running on the system "witcher.mxrouting.net", has
 performed the tests listed below against this email.
 Information: https://mxroutedocs.com/directadmin/spamfilters/
 ---
 Content analysis details:   (0.5 points)
 ---
  pts rule name              description
 ---- ---------------------- -----------------------------------------
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
SpamTally: Final spam score: 5

From: Luis de Arquer <luis.dearquer@inertim.com>

commit 7a874e8b54ea21094f7fd2d428b164394c6cb316 upstream.

Do not write native chip select stuff for GPIO chip selects.
GPIOs can be numbered much higher than native CS.
Also, it makes no sense.

Fixes: 736b81e07517 ("spi: rockchip: Support SPI_CS_HIGH")
Signed-off-by: Luis de Arquer <luis.dearquer@inertim.com>
Link: https://patch.msgid.link/365ccddfba110549202b3520f4401a6a936e82a8.camel@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
[ kovalev: bp to fix CVE-2025-38081; added Fixes tag ]
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
---
 drivers/spi/spi-rockchip.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
index dbefc7e77313..cba858a7b4f9 100644
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -540,8 +540,8 @@ static int rockchip_spi_config(struct rockchip_spi *rs,
 	cr0 |= (spi->mode & 0x3U) << CR0_SCPH_OFFSET;
 	if (spi->mode & SPI_LSB_FIRST)
 		cr0 |= CR0_FBM_LSB << CR0_FBM_OFFSET;
-	if (spi->mode & SPI_CS_HIGH)
-		cr0 |= BIT(spi->chip_select) << CR0_SOI_OFFSET;
+	if ((spi->mode & SPI_CS_HIGH) && !(spi_get_csgpiod(spi, 0)))
+		cr0 |= BIT(spi_get_chipselect(spi, 0)) << CR0_SOI_OFFSET;
 
 	if (xfer->rx_buf && xfer->tx_buf)
 		cr0 |= CR0_XFM_TR << CR0_XFM_OFFSET;
-- 
2.50.1



From - Thu Oct 23 21:49:39 2025
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <linux-s390+bounces-14159-hi=josie.lol@vger.kernel.org>
Delivered-To: hi@josie.lol
Received: from witcher.mxrouting.net
	by witcher.mxrouting.net with LMTP
	id MBoFGu+i+mj3cCYAYBR5ng
	(envelope-from <linux-s390+bounces-14159-hi=josie.lol@vger.kernel.org>)
	for <hi@josie.lol>; Thu, 23 Oct 2025 21:49:35 +0000
Return-path: <linux-s390+bounces-14159-hi=josie.lol@vger.kernel.org>
Envelope-to: hi@josie.lol
Delivery-date: Thu, 23 Oct 2025 21:49:35 +0000
Received: from am.mirrors.kernel.org ([147.75.80.249])
	by witcher.mxrouting.net with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <linux-s390+bounces-14159-hi=josie.lol@vger.kernel.org>)
	id 1vC3Be-0000000AoPh-3IxU
	for hi@josie.lol;
	Thu, 23 Oct 2025 21:49:35 +0000
Received: from smtp.subspace.kernel.org (relay.kernel.org [52.25.139.140])
	(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by am.mirrors.kernel.org (Postfix) with ESMTPS id C79C4189EAEE
	for <hi@josie.lol>; Thu, 23 Oct 2025 21:49:57 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by smtp.subspace.kernel.org (Postfix) with ESMTP id 3ED741991D2;
	Thu, 23 Oct 2025 21:49:32 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="QPmTyuxl"
X-Original-To: linux-s390@vger.kernel.org
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 15DEB3D3B3;
	Thu, 23 Oct 2025 21:49:31 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1761256172; cv=none; b=q4mKNpU7e+csDdZNpQkTI/cRA7C3wIKMPVmHBR3n9t0ylJlwLUsQvD3yeZtU1HHzxR9crZN2cvN09UMX7G2V79W1wyterP5rKti7EN+1nU8YUbwYaO4cUX4gCQQXMTNjzNEymMXD8WVIGmhHiw4xCdBt+jNMNQMaCBIkdC8tDbM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1761256172; c=relaxed/simple;
	bh=wDOxZQ8Gop+DTsDQM7SH+b6uxnF3XzCxIS2tKokpfFg=;
	h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:
	 Content-Type:Content-Disposition:In-Reply-To; b=FaaGmDeunzssidxxdPrDce5iy9vNMwLeKIZ/bcOtGCBMfkznk6CxPCPHElDOScwcZgLc3mDKdmdt8GSTHECKx4CBYo2amZGIax4F6ZnD5o5GbBM5tmauQSFLPOIjCah+ka0JzXGNystCTAA34ET6HqrAjWpxSZualNx+F0Hthv8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=QPmTyuxl; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3497C4CEE7;
	Thu, 23 Oct 2025 21:49:31 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
	s=k20201202; t=1761256171;
	bh=wDOxZQ8Gop+DTsDQM7SH+b6uxnF3XzCxIS2tKokpfFg=;
	h=Date:From:To:Cc:Subject:Reply-To:References:In-Reply-To:From;
	b=QPmTyuxl02zrQspR5uGrnQeccVO45UOA4owzzMLQJwG