[PATCH] mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

[PATCH] mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

[Arnd Bergmann]

From: Arnd Bergmann <arnd@arndb.de>

Two large spi_nor_flash_parameter structures on a function stack
is really too much, and this can exceed an otherwise reasonable
frame limit:

drivers/mtd/spi-nor/sfdp.c: In function 'spi_nor_parse_sfdp':
drivers/mtd/spi-nor/sfdp.c:1717:1: error: the frame size of 1600 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]

Change one of them to a dynamic allocation to make this more reasonable.

Fixes: d20029474a76 ("mtd: spi-nor: push the rollback mechanism into the sfdp module")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 drivers/mtd/spi-nor/sfdp.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
index c21a6953db96..5d0901074f50 100644
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -1520,7 +1520,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
 {
 	const struct sfdp_parameter_header *param_header, *bfpt_header;
 	struct sfdp_parameter_header *param_headers = NULL;
-	struct spi_nor_flash_parameter params, params2;
+	struct spi_nor_flash_parameter __free(kfree) *params = NULL;
 	struct sfdp_header header;
 	struct device *dev = nor->dev;
 	struct sfdp *sfdp;
@@ -1532,7 +1532,9 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
 	 * Get a backup of all the parameter to roll back to in case of an
 	 * error.
 	 */
-	memcpy(&params, nor->params, sizeof(params));
+	params = kmemdup(nor->params, sizeof(*params), GFP_KERNEL);
+	if (!params)
+		return -ENOMEM;
 
 	/* Get the SFDP header. */
 	err = spi_nor_read_sfdp_dma_unsafe(nor, 0, sizeof(header), &header);
@@ -1652,6 +1654,8 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
 
 	/* Parse optional parameter tables. */
 	for (i = 0; i < header.nph; i++) {
+		struct spi_nor_flash_parameter params2;
+
 		memcpy(&params2, nor->params, sizeof(params2));
 		param_header = &param_headers[i];
 
@@ -1711,7 +1715,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
 free_param_headers:
 	kfree(param_headers);
 	if (err)
-		memcpy(nor->params, &params, sizeof(*nor->params));
+		memcpy(nor->params, params, sizeof(*nor->params));
 
 	return err;
 }
-- 
2.53.0

Re: [PATCH] mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] mtd: spi-nor: mixing goto and scope-based cleanup in spi_nor_parse_sfdp()
- [Low] mtd: spi-nor: split definition and initialization of __free() variable
--

commit 1f040dc109ef8aa4b9fc1c81bcaa8f6e6a5a27c0
Author: Arnd Bergmann <arnd@arndb.de>

mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

This commit reduces stack usage in spi_nor_parse_sfdp() by replacing an
on-stack struct spi_nor_flash_parameter variable with a dynamically allocated
one. It utilizes the __free(kfree) scope-based cleanup helper to manage the
allocated memory.

> diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
> index 641f17ad51a09..466558ea528d8 100644
> --- a/drivers/mtd/spi-nor/sfdp.c
> +++ b/drivers/mtd/spi-nor/sfdp.c
> @@ -1521,7 +1521,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  {
>  	const struct sfdp_parameter_header *param_header, *bfpt_header;
>  	struct sfdp_parameter_header *param_headers = NULL;
> -	struct spi_nor_flash_parameter params, params2;
> +	struct spi_nor_flash_parameter __free(kfree) *params = NULL;

[Severity: Low]
Does this split definition and initialization of the params pointer violate
the cleanup subsystem guidelines?

The guidelines recommend defining and initializing scope-based cleanup
variables in a single statement (such as at the kmemdup call below) rather
than initializing to NULL at the top with assignment later. While this
specific case might not trigger a LIFO ordering bug since there are no
guard() locks present, it does bypass the subsystem recommendation designed
to prevent those ordering mistakes.

>  	struct sfdp_header header;
>  	struct device *dev = nor->dev;
>  	struct sfdp *sfdp;
> @@ -1533,7 +1533,9 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  	 * Get a backup of all the parameter to roll back to in case of an
>  	 * error.
>  	 */
> -	memcpy(&params, nor->params, sizeof(params));
> +	params = kmemdup(nor->params, sizeof(*params), GFP_KERNEL);
> +	if (!params)
> +		return -ENOMEM;
>  
>  	/* Get the SFDP header. */

[ ... ]

> @@ -1712,7 +1716,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  free_param_headers:
>  	kfree(param_headers);
>  	if (err)
> -		memcpy(nor->params, &params, sizeof(*nor->params));
> +		memcpy(nor->params, params, sizeof(*nor->params));
>  
>  	return err;
>  }

[Severity: Medium]
Is it safe to mix goto-based error handling with scope-based cleanup in
this function?

The kernel cleanup subsystem guidelines dictate that goto-based error
handling and scope-based cleanups should never be mixed in the same
function. Retaining the free_param_headers goto label and other manual
cleanups in spi_nor_parse_sfdp() while introducing __free(kfree) for params
violates the 'all-or-nothing' conversion rule and can create confusing
ownership semantics.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260915194203.3511147-1-arnd@kernel.org?part=1

Re: [PATCH] mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

[David Laight]

On Tue, 15 Sep 2026 21:40:31 +0200
Arnd Bergmann <arnd@kernel.org> wrote:

> From: Arnd Bergmann <arnd@arndb.de>
> 
> Two large spi_nor_flash_parameter structures on a function stack
> is really too much, and this can exceed an otherwise reasonable
> frame limit:
> 
> drivers/mtd/spi-nor/sfdp.c: In function 'spi_nor_parse_sfdp':
> drivers/mtd/spi-nor/sfdp.c:1717:1: error: the frame size of 1600 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
> 
> Change one of them to a dynamic allocation to make this more reasonable.

It wouldn't be much more complicated to do a single kmalloc() for both.
Then replace then memcpy() with structure copies for type safety.

Might stop saskiko bleating as well.

David
 
> 
> Fixes: d20029474a76 ("mtd: spi-nor: push the rollback mechanism into the sfdp module")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
>  drivers/mtd/spi-nor/sfdp.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
> index c21a6953db96..5d0901074f50 100644
> --- a/drivers/mtd/spi-nor/sfdp.c
> +++ b/drivers/mtd/spi-nor/sfdp.c
> @@ -1520,7 +1520,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  {
>  	const struct sfdp_parameter_header *param_header, *bfpt_header;
>  	struct sfdp_parameter_header *param_headers = NULL;
> -	struct spi_nor_flash_parameter params, params2;
> +	struct spi_nor_flash_parameter __free(kfree) *params = NULL;
>  	struct sfdp_header header;
>  	struct device *dev = nor->dev;
>  	struct sfdp *sfdp;
> @@ -1532,7 +1532,9 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  	 * Get a backup of all the parameter to roll back to in case of an
>  	 * error.
>  	 */
> -	memcpy(&params, nor->params, sizeof(params));
> +	params = kmemdup(nor->params, sizeof(*params), GFP_KERNEL);
> +	if (!params)
> +		return -ENOMEM;
>  
>  	/* Get the SFDP header. */
>  	err = spi_nor_read_sfdp_dma_unsafe(nor, 0, sizeof(header), &header);
> @@ -1652,6 +1654,8 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  
>  	/* Parse optional parameter tables. */
>  	for (i = 0; i < header.nph; i++) {
> +		struct spi_nor_flash_parameter params2;
> +
>  		memcpy(&params2, nor->params, sizeof(params2));
>  		param_header = &param_headers[i];
>  
> @@ -1711,7 +1715,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  free_param_headers:
>  	kfree(param_headers);
>  	if (err)
> -		memcpy(nor->params, &params, sizeof(*nor->params));
> +		memcpy(nor->params, params, sizeof(*nor->params));
>  
>  	return err;
>  }