[PATCH] spi: mt65xx: Remove the CPU latency QoS request when probe fails

[Rui Cao via B4 Relay]

From: Rui Cao <i@xxxxxxxx>

mtk_spi_probe() adds its CPU latency QoS request before the chip select
checks, the interrupt request and spi_register_controller(), and none of
their error paths removes it again. The request is embedded in the
driver's private data, which devres frees once the probe has failed, so
the global CPU latency constraint list keeps a node in freed memory. The
next cpu_latency_qos_add_request() from any driver walks into it.

On a Redmi Note 13 5G (MT6833), an SPI controller whose probe failed the
pad_num/num_chipselect check left such a node behind, and the UFS host
adding its own request a moment later oopsed in plist_add():

Unable to handle kernel paging request at virtual address fffffffffffffff8

The same happens whenever spi_register_controller() fails, which
includes -EPROBE_DEFER while the chip select GPIOs are looked up.

Nothing needs the request before the controller is registered: only the
prepare_message() and unprepare_message() callbacks update it. Add it
just before the registration and remove it if the registration fails.

Fixes: 632556d5799a ("spi: mt65xx: add PM QoS support")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Rui Cao <i@xxxxxxxx>
---
 drivers/spi/spi-mt65xx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
index b845a599f7c..49c31d4bd71 100644
--- a/drivers/spi/spi-mt65xx.c
+++ b/drivers/spi/spi-mt65xx.c
@@ -1295,8 +1295,6 @@ static int mtk_spi_probe(struct platform_device *pdev)
 		clk_disable_unprepare(mdata->spi_hclk);
 	}
 
-	cpu_latency_qos_add_request(&mdata->qos_request, PM_QOS_DEFAULT_VALUE);
-
 	if (mdata->dev_comp->need_pad_sel) {
 		if (mdata->pad_num != host->num_chipselect)
 			return dev_err_probe(dev, -EINVAL,
@@ -1323,11 +1321,13 @@ static int mtk_spi_probe(struct platform_device *pdev)
 	if (ret)
 		return dev_err_probe(dev, ret, "failed to register irq\n");
 
+	cpu_latency_qos_add_request(&mdata->qos_request, PM_QOS_DEFAULT_VALUE);
 	pm_runtime_enable(dev);
 
 	ret = spi_register_controller(host);
 	if (ret) {
 		pm_runtime_disable(dev);
+		cpu_latency_qos_remove_request(&mdata->qos_request);
 		return dev_err_probe(dev, ret, "failed to register host\n");
 	}
 

---
base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
change-id: 20261107-mt65xx-qos-fix-32c41fd385da

Best regards,
--  
Rui Cao <i@xxxxxxxx>