jcore_spi_baudrate() computes hw->clock_freq / 2 / speed without validating speed. The SPI core fills transfer.speed_hz from spi->max_speed_hz when it is zero, and jcore_spi_probe() never sets host->max_speed_hz, so the clamp in __spi_setup() is skipped. A spi_device created via the sysfs new_device interface (or a DT node without spi-max-frequency) therefore has max_speed_hz == 0, and any SPI_IOC_MESSAGE transfer reaches jcore_spi_baudrate() with speed == 0, causing a division by zero and a kernel panic. Clamp speed to a minimum of 1 Hz before the division so the divisor is never zero. The computed divider then truncates to the register field width and the transfer simply runs at the slowest supported rate. Verified by inspection of the __spi_setup() clamp and __spi_validate()'s speed_hz handling; the division-by-zero path requires the J-Core controller, which was not available. Reviewed-by: Guanglei Zhu Fixes: 2cb1b3b3ac0a ("spi: add driver for J-Core SPI controller") Cc: stable@vger.kernel.org # 4.9+ Signed-off-by: Weibin Liu --- drivers/spi/spi-jcore.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/spi/spi-jcore.c b/drivers/spi/spi-jcore.c index a75cd61ec7a3..fc87ad98e4e7 100644 --- a/drivers/spi/spi-jcore.c +++ b/drivers/spi/spi-jcore.c @@ -84,6 +84,8 @@ static void jcore_spi_baudrate(struct jcore_spi *hw, int speed) { if (speed == hw->speed_hz) return; + if (speed <= 0) + speed = 1; hw->speed_hz = speed; if (speed >= hw->clock_freq / 2) hw->speed_reg = 0; --- base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907 change-id: 20261014-spi-jcore-divzero-beb7d7925838 Best regards, -- Weibin Liu