[PATCH 0/2] spi: offload: fixes

[PATCH 0/2] spi: offload: fixes

[David Lechner]

Fix a couple of issues that were reported with the recently added SPI
offload series.

Signed-off-by: David Lechner <dlechner@baylibre.com>
---
David Lechner (2):
      spi: fix missing offload_flags doc
      spi: offload: fix use after free

 drivers/spi/spi-offload.c | 13 ++++++++-----
 include/linux/spi/spi.h   |  2 ++
 2 files changed, 10 insertions(+), 5 deletions(-)
---
base-commit: 6cc789bf76b1f414791c69227e6c21ec41115213
change-id: 20250212-spi-offload-fixes-34a8abe6417e

Best regards,
-- 
David Lechner <dlechner@baylibre.com>

[PATCH 1/2] spi: fix missing offload_flags doc

[David Lechner]

Add offload_flags to the documentation comment for struct spi_transfer.
This was missed when adding the field.

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Closes: https://lore.kernel.org/linux-next/20250212154356.784944ea@canb.auug.org.au/
Fixes: 700a281905f2 ("spi: add offload TX/RX streaming APIs")
Signed-off-by: David Lechner <dlechner@baylibre.com>
---
 include/linux/spi/spi.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index 4c087009cf974595f23036b1b7a030a45913420c..8d5c7da39c855ea35ff37cef4fddbeccb9a9388e 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -973,6 +973,8 @@ struct spi_res {
  * @rx_sg_mapped: If true, the @rx_sg is mapped for DMA
  * @tx_sg: Scatterlist for transmit, currently not for client use
  * @rx_sg: Scatterlist for receive, currently not for client use
+ * @offload_flags: Flags that are only applicable to specialized SPI offload
+ *	transfers. See %SPI_OFFLOAD_XFER_* in spi-offload.h.
  * @ptp_sts_word_pre: The word (subject to bits_per_word semantics) offset
  *	within @tx_buf for which the SPI device is requesting that the time
  *	snapshot for this transfer begins. Upon completing the SPI transfer,

-- 
2.43.0

[PATCH 2/2] spi: offload: fix use after free

[David Lechner]

Fix a use after free bug in devm_spi_offload_get() where a pointer
was dereferenced after being freed. Instead, add a new local variable
to avoid needing to use the resource pointer to access the offload
pointer.

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202502112344.7ggtFzyn-lkp@intel.com/
Fixes: 5a19e1985d01 ("spi: axi-spi-engine: implement offload support")
Signed-off-by: David Lechner <dlechner@baylibre.com>
---
 drivers/spi/spi-offload.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/spi/spi-offload.c b/drivers/spi/spi-offload.c
index df5e963d5ee29d37833559595536a460c530bc81..6bad042fe4373e8b91dae3154ef5e22744a4acd0 100644
--- a/drivers/spi/spi-offload.c
+++ b/drivers/spi/spi-offload.c
@@ -108,6 +108,7 @@ struct spi_offload *devm_spi_offload_get(struct device *dev,
 					 const struct spi_offload_config *config)
 {
 	struct spi_controller_and_offload *resource;
+	struct spi_offload *offload;
 	int ret;
 
 	if (!spi || !config)
@@ -120,18 +121,20 @@ struct spi_offload *devm_spi_offload_get(struct device *dev,
 	if (!resource)
 		return ERR_PTR(-ENOMEM);
 
-	resource->controller = spi->controller;
-	resource->offload = spi->controller->get_offload(spi, config);
-	if (IS_ERR(resource->offload)) {
+	offload = spi->controller->get_offload(spi, config);
+	if (IS_ERR(offload)) {
 		kfree(resource);
-		return resource->offload;
+		return offload;
 	}
 
+	resource->controller = spi->controller;
+	resource->offload = offload;
+
 	ret = devm_add_action_or_reset(dev, spi_offload_put, resource);
 	if (ret)
 		return ERR_PTR(ret);
 
-	return resource->offload;
+	return offload;
 }
 EXPORT_SYMBOL_GPL(devm_spi_offload_get);
 

-- 
2.43.0

Re: [PATCH 0/2] spi: offload: fixes

[Mark Brown]

On Wed, 12 Feb 2025 11:33:11 -0600, David Lechner wrote:
> Fix a couple of issues that were reported with the recently added SPI
> offload series.
> 
> 

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-next

Thanks!

[1/2] spi: fix missing offload_flags doc
      commit: d795a052b0ddad3da83dda6ff522c1b1aaa4a525
[2/2] spi: offload: fix use after free
      commit: e957c96455e8f4c630d5e374312cad0633ca7e17

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark