[PATCH] spi: axi-spi-engine: Start the program length at zero

[PATCH] spi: axi-spi-engine: Start the program length at zero

[Kees Cook]

spi_engine_optimize_message() allocates the program with kzalloc_flex(),
which sets the __counted_by() counter "length" to the allocated size when
the compiler supports __builtin_counted_by_ref(). The program is then
filled by spi_engine_program_add_cmd(), which increments "length" and
stores at length - 1, expecting it to start at zero as it did when the
program came from kzalloc().

Reset "length" after the allocation, since it is a "usage" counter, not
a "total allocation" counter.

Build tested ARCH=x86_64 defconfig with CONFIG_SPI_AXI_SPI_ENGINE=m and
W=1, with GCC 16.2.0.

Reported-by: Dennis Gilmore <dennis@ausil.us>
Closes: https://lore.kernel.org/all/20261112025252.71375-1-dennis@ausil.us/
Fixes: 69050f8d6d075 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
---
 drivers/spi/spi-axi-spi-engine.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-axi-spi-engine.c b/drivers/spi/spi-axi-spi-engine.c
index ead5b295e680..9cfee409f15c 100644
--- a/drivers/spi/spi-axi-spi-engine.c
+++ b/drivers/spi/spi-axi-spi-engine.c
@@ -818,6 +818,8 @@ static int spi_engine_optimize_message(struct spi_message *msg)
 	p = kzalloc_flex(*p, instructions, p_dry.length + 1);
 	if (!p)
 		return -ENOMEM;
+	/* spi_engine_program_add_cmd() counts the instructions as it adds them. */
+	p->length = 0;
 
 	spi_engine_compile_message(msg, false, p);
 
-- 
2.55.0

Re: [PATCH] spi: axi-spi-engine: Start the program length at zero

[David Lechner]

On 11/13/26 12:55 AM, Kees Cook wrote:
> spi_engine_optimize_message() allocates the program with kzalloc_flex(),
> which sets the __counted_by() counter "length" to the allocated size when
> the compiler supports __builtin_counted_by_ref(). The program is then
> filled by spi_engine_program_add_cmd(), which increments "length" and
> stores at length - 1, expecting it to start at zero as it did when the
> program came from kzalloc().
> 
> Reset "length" after the allocation, since it is a "usage" counter, not
> a "total allocation" counter.
> 
> Build tested ARCH=x86_64 defconfig with CONFIG_SPI_AXI_SPI_ENGINE=m and
> W=1, with GCC 16.2.0.
> 
> Reported-by: Dennis Gilmore <dennis@ausil.us>
> Closes: https://lore.kernel.org/all/20261112025252.71375-1-dennis@ausil.us/
> Fixes: 69050f8d6d075 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kees Cook <kees@kernel.org>
> ---

Reviewed-by: David Lechner <dlechner@baylibre.com>

>  drivers/spi/spi-axi-spi-engine.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/spi/spi-axi-spi-engine.c b/drivers/spi/spi-axi-spi-engine.c
> index ead5b295e680..9cfee409f15c 100644
> --- a/drivers/spi/spi-axi-spi-engine.c
> +++ b/drivers/spi/spi-axi-spi-engine.c
> @@ -818,6 +818,8 @@ static int spi_engine_optimize_message(struct spi_message *msg)
>  	p = kzalloc_flex(*p, instructions, p_dry.length + 1);
>  	if (!p)
>  		return -ENOMEM;
> +	/* spi_engine_program_add_cmd() counts the instructions as it adds them. */
> +	p->length = 0;
>  
>  	spi_engine_compile_message(msg, false, p);
>