Re: [PATCH v5 0/3] Input/SPI: fixes for MacBook8,1 DMA timeout, UAF, and NULL pointer dereference
From: Shih-Yuan Lee <hidden>
Date: 2026-07-12 16:05:25
Also in:
linux-spi, lkml
Hi Dmitry, Mark, and the linux-input/linux-spi community, Thank you for all the feedback across v1 through v5 of this series. During further testing on the MacBook8,1 hardware, I discovered two additional issues that change the scope of the fix: 1. The LPSS SPI controller (00:15.4) loses all private register state across S3 suspend/resume. Restoring only the SSP clock on resume, without de-asserting LPSS_PRIV_RESETS (0x204) first, causes a PCIe Completion Timeout and a watchdog-triggered system reset. Additionally, the IDMA block (which shares the SPI interrupt line) needs its registers restored to prevent spurious interrupts from masking real SPI transfers. This is a generic LPSS fix in spi-pxa2xx.c, not specific to MacBook8,1. 2. The applespi_remove() teardown has a use-after-free race between the drain_writes/drain_reads calls and the GPE handler removal. Given these changes, the patch series has grown and now spans two subsystems more cleanly than before: [input] Input: applespi - register touchpad device synchronously in probe [input] Input: applespi - fix use-after-free in applespi_remove() [spi] spi: pxa2xx: disable DMA and fix runtime PM for Apple MacBook8,1 [spi] spi: pxa2xx: restore LPSS private and IDMA registers on S3 resume I will submit these as two separate series to linux-input and linux-spi respectively rather than continuing this thread, to keep subsystem boundaries clean. Thanks again for your patience and review. Shih-Yuan Lee -- 2.39.5