[PATCH] mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

[PATCH] mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

[Arnd Bergmann]

From: Arnd Bergmann <arnd@arndb.de>

Two large spi_nor_flash_parameter structures on a function stack
is really too much, and this can exceed an otherwise reasonable
frame limit:

drivers/mtd/spi-nor/sfdp.c: In function 'spi_nor_parse_sfdp':
drivers/mtd/spi-nor/sfdp.c:1717:1: error: the frame size of 1600 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]

Change one of them to a dynamic allocation to make this more reasonable.

Fixes: d20029474a76 ("mtd: spi-nor: push the rollback mechanism into the sfdp module")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 drivers/mtd/spi-nor/sfdp.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
index c21a6953db96..5d0901074f50 100644
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -1520,7 +1520,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
 {
 	const struct sfdp_parameter_header *param_header, *bfpt_header;
 	struct sfdp_parameter_header *param_headers = NULL;
-	struct spi_nor_flash_parameter params, params2;
+	struct spi_nor_flash_parameter __free(kfree) *params = NULL;
 	struct sfdp_header header;
 	struct device *dev = nor->dev;
 	struct sfdp *sfdp;
@@ -1532,7 +1532,9 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
 	 * Get a backup of all the parameter to roll back to in case of an
 	 * error.
 	 */
-	memcpy(&params, nor->params, sizeof(params));
+	params = kmemdup(nor->params, sizeof(*params), GFP_KERNEL);
+	if (!params)
+		return -ENOMEM;
 
 	/* Get the SFDP header. */
 	err = spi_nor_read_sfdp_dma_unsafe(nor, 0, sizeof(header), &header);
@@ -1652,6 +1654,8 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
 
 	/* Parse optional parameter tables. */
 	for (i = 0; i < header.nph; i++) {
+		struct spi_nor_flash_parameter params2;
+
 		memcpy(&params2, nor->params, sizeof(params2));
 		param_header = &param_headers[i];
 
@@ -1711,7 +1715,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
 free_param_headers:
 	kfree(param_headers);
 	if (err)
-		memcpy(nor->params, &params, sizeof(*nor->params));
+		memcpy(nor->params, params, sizeof(*nor->params));
 
 	return err;
 }
-- 
2.53.0

Re: [PATCH] mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] mtd: spi-nor: mixing goto and scope-based cleanup in spi_nor_parse_sfdp()
- [Low] mtd: spi-nor: split definition and initialization of __free() variable
--

commit 1f040dc109ef8aa4b9fc1c81bcaa8f6e6a5a27c0
Author: Arnd Bergmann <arnd@arndb.de>

mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

This commit reduces stack usage in spi_nor_parse_sfdp() by replacing an
on-stack struct spi_nor_flash_parameter variable with a dynamically allocated
one. It utilizes the __free(kfree) scope-based cleanup helper to manage the
allocated memory.

> diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
> index 641f17ad51a09..466558ea528d8 100644
> --- a/drivers/mtd/spi-nor/sfdp.c
> +++ b/drivers/mtd/spi-nor/sfdp.c
> @@ -1521,7 +1521,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  {
>  	const struct sfdp_parameter_header *param_header, *bfpt_header;
>  	struct sfdp_parameter_header *param_headers = NULL;
> -	struct spi_nor_flash_parameter params, params2;
> +	struct spi_nor_flash_parameter __free(kfree) *params = NULL;

[Severity: Low]
Does this split definition and initialization of the params pointer violate
the cleanup subsystem guidelines?

The guidelines recommend defining and initializing scope-based cleanup
variables in a single statement (such as at the kmemdup call below) rather
than initializing to NULL at the top with assignment later. While this
specific case might not trigger a LIFO ordering bug since there are no
guard() locks present, it does bypass the subsystem recommendation designed
to prevent those ordering mistakes.

>  	struct sfdp_header header;
>  	struct device *dev = nor->dev;
>  	struct sfdp *sfdp;
> @@ -1533,7 +1533,9 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  	 * Get a backup of all the parameter to roll back to in case of an
>  	 * error.
>  	 */
> -	memcpy(&params, nor->params, sizeof(params));
> +	params = kmemdup(nor->params, sizeof(*params), GFP_KERNEL);
> +	if (!params)
> +		return -ENOMEM;
>  
>  	/* Get the SFDP header. */

[ ... ]

> @@ -1712,7 +1716,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  free_param_headers:
>  	kfree(param_headers);
>  	if (err)
> -		memcpy(nor->params, &params, sizeof(*nor->params));
> +		memcpy(nor->params, params, sizeof(*nor->params));
>  
>  	return err;
>  }

[Severity: Medium]
Is it safe to mix goto-based error handling with scope-based cleanup in
this function?

The kernel cleanup subsystem guidelines dictate that goto-based error
handling and scope-based cleanups should never be mixed in the same
function. Retaining the free_param_headers goto label and other manual
cleanups in spi_nor_parse_sfdp() while introducing __free(kfree) for params
violates the 'all-or-nothing' conversion rule and can create confusing
ownership semantics.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260915194203.3511147-1-arnd@kernel.org?part=1

Re: [PATCH] mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

[David Laight]

On Tue, 15 Sep 2026 21:40:31 +0200
Arnd Bergmann <arnd@kernel.org> wrote:

> From: Arnd Bergmann <arnd@arndb.de>
> 
> Two large spi_nor_flash_parameter structures on a function stack
> is really too much, and this can exceed an otherwise reasonable
> frame limit:
> 
> drivers/mtd/spi-nor/sfdp.c: In function 'spi_nor_parse_sfdp':
> drivers/mtd/spi-nor/sfdp.c:1717:1: error: the frame size of 1600 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
> 
> Change one of them to a dynamic allocation to make this more reasonable.

It wouldn't be much more complicated to do a single kmalloc() for both.
Then replace then memcpy() with structure copies for type safety.

Might stop saskiko bleating as well.

David
 
> 
> Fixes: d20029474a76 ("mtd: spi-nor: push the rollback mechanism into the sfdp module")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
>  drivers/mtd/spi-nor/sfdp.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
> index c21a6953db96..5d0901074f50 100644
> --- a/drivers/mtd/spi-nor/sfdp.c
> +++ b/drivers/mtd/spi-nor/sfdp.c
> @@ -1520,7 +1520,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  {
>  	const struct sfdp_parameter_header *param_header, *bfpt_header;
>  	struct sfdp_parameter_header *param_headers = NULL;
> -	struct spi_nor_flash_parameter params, params2;
> +	struct spi_nor_flash_parameter __free(kfree) *params = NULL;
>  	struct sfdp_header header;
>  	struct device *dev = nor->dev;
>  	struct sfdp *sfdp;
> @@ -1532,7 +1532,9 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  	 * Get a backup of all the parameter to roll back to in case of an
>  	 * error.
>  	 */
> -	memcpy(&params, nor->params, sizeof(params));
> +	params = kmemdup(nor->params, sizeof(*params), GFP_KERNEL);
> +	if (!params)
> +		return -ENOMEM;
>  
>  	/* Get the SFDP header. */
>  	err = spi_nor_read_sfdp_dma_unsafe(nor, 0, sizeof(header), &header);
> @@ -1652,6 +1654,8 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  
>  	/* Parse optional parameter tables. */
>  	for (i = 0; i < header.nph; i++) {
> +		struct spi_nor_flash_parameter params2;
> +
>  		memcpy(&params2, nor->params, sizeof(params2));
>  		param_header = &param_headers[i];
>  
> @@ -1711,7 +1715,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  free_param_headers:
>  	kfree(param_headers);
>  	if (err)
> -		memcpy(nor->params, &params, sizeof(*nor->params));
> +		memcpy(nor->params, params, sizeof(*nor->params));
>  
>  	return err;
>  }

Re: [PATCH] mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

[Michael Walle]

[-- Attachment #1: Type: text/plain, Size: 887 bytes --]

Hi Arnd,

On Tue Sep 15, 2026 at 9:40 PM CEST, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@arndb.de>
>
> Two large spi_nor_flash_parameter structures on a function stack
> is really too much, and this can exceed an otherwise reasonable
> frame limit:
>
> drivers/mtd/spi-nor/sfdp.c: In function 'spi_nor_parse_sfdp':
> drivers/mtd/spi-nor/sfdp.c:1717:1: error: the frame size of 1600 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
>
> Change one of them to a dynamic allocation to make this more reasonable.

Thanks for taking care of that. Will you respin the patch with what
David suggested?

-michael

> Fixes: d20029474a76 ("mtd: spi-nor: push the rollback mechanism into the sfdp module")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
>  drivers/mtd/spi-nor/sfdp.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 297 bytes --]

Re: [PATCH] mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

[David Laight]

On Mon, 21 Sep 2026 09:55:37 +0200
"Michael Walle" <mwalle@kernel.org> wrote:

> Hi Arnd,
> 
> On Tue Sep 15, 2026 at 9:40 PM CEST, Arnd Bergmann wrote:
> > From: Arnd Bergmann <arnd@arndb.de>
> >
> > Two large spi_nor_flash_parameter structures on a function stack
> > is really too much, and this can exceed an otherwise reasonable
> > frame limit:
> >
> > drivers/mtd/spi-nor/sfdp.c: In function 'spi_nor_parse_sfdp':
> > drivers/mtd/spi-nor/sfdp.c:1717:1: error: the frame size of 1600 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
> >
> > Change one of them to a dynamic allocation to make this more reasonable.  
> 
> Thanks for taking care of that. Will you respin the patch with what
> David suggested?

This compiles...
David

diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
index 641f17ad51a0..cec699b52f27 100644
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -1519,9 +1519,9 @@ int spi_nor_check_sfdp_signature(struct spi_nor *nor)
  */
 int spi_nor_parse_sfdp(struct spi_nor *nor)
 {
+       struct spi_nor_flash_parameter sv_params __free(kfree) = kmalloc_objs(*sv_params, 2);
        const struct sfdp_parameter_header *param_header, *bfpt_header;
        struct sfdp_parameter_header *param_headers = NULL;
-       struct spi_nor_flash_parameter params, params2;
        struct sfdp_header header;
        struct device *dev = nor->dev;
        struct sfdp *sfdp;
@@ -1533,7 +1533,9 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
         * Get a backup of all the parameter to roll back to in case of an
         * error.
         */
-       memcpy(&params, nor->params, sizeof(params));
+       if (!sv_params)
+               return -ENOMEM
+       sv_params[0] = nor->params;

        /* Get the SFDP header. */
        err = spi_nor_read_sfdp_dma_unsafe(nor, 0, sizeof(header), &header);
@@ -1653,7 +1655,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)

        /* Parse optional parameter tables. */
        for (i = 0; i < header.nph; i++) {
-               memcpy(&params2, nor->params, sizeof(params2));
+               sv_params[1] nor->params;
                param_header = &param_headers[i];

                switch (SFDP_PARAM_HEADER_ID(param_header)) {
@@ -1691,7 +1693,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
                         * spi_nor_flash_parameter data.
                         */
                        err = 0;
-                       memcpy(nor->params, &params2, sizeof(*nor->params));
+                       nor->params = sv_params[1];
                }
        }

@@ -1712,7 +1714,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
 free_param_headers:
        kfree(param_headers);
        if (err)
-               memcpy(nor->params, &params, sizeof(*nor->params));
+               nor->params = sv_params[0];

        return err;
 }
--

> 
> -michael
> 
> > Fixes: d20029474a76 ("mtd: spi-nor: push the rollback mechanism into the sfdp module")
> > Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> > ---
> >  drivers/mtd/spi-nor/sfdp.c | 10 +++++++---
> >  1 file changed, 7 insertions(+), 3 deletions(-)  

Re: [PATCH] mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

[Michael Walle]

[-- Attachment #1: Type: text/plain, Size: 3489 bytes --]

On Mon Sep 21, 2026 at 10:59 AM CEST, David Laight wrote:
> On Mon, 21 Sep 2026 09:55:37 +0200
> "Michael Walle" <mwalle@kernel.org> wrote:
>
>> Hi Arnd,
>> 
>> On Tue Sep 15, 2026 at 9:40 PM CEST, Arnd Bergmann wrote:
>> > From: Arnd Bergmann <arnd@arndb.de>
>> >
>> > Two large spi_nor_flash_parameter structures on a function stack
>> > is really too much, and this can exceed an otherwise reasonable
>> > frame limit:
>> >
>> > drivers/mtd/spi-nor/sfdp.c: In function 'spi_nor_parse_sfdp':
>> > drivers/mtd/spi-nor/sfdp.c:1717:1: error: the frame size of 1600 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
>> >
>> > Change one of them to a dynamic allocation to make this more reasonable.  
>> 
>> Thanks for taking care of that. Will you respin the patch with what
>> David suggested?
>
> This compiles...
> David
>
> diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
> index 641f17ad51a0..cec699b52f27 100644
> --- a/drivers/mtd/spi-nor/sfdp.c
> +++ b/drivers/mtd/spi-nor/sfdp.c
> @@ -1519,9 +1519,9 @@ int spi_nor_check_sfdp_signature(struct spi_nor *nor)
>   */
>  int spi_nor_parse_sfdp(struct spi_nor *nor)
>  {
> +       struct spi_nor_flash_parameter sv_params __free(kfree) = kmalloc_objs(*sv_params, 2);

What does sv_ stands for?

>         const struct sfdp_parameter_header *param_header, *bfpt_header;
>         struct sfdp_parameter_header *param_headers = NULL;
> -       struct spi_nor_flash_parameter params, params2;
>         struct sfdp_header header;
>         struct device *dev = nor->dev;
>         struct sfdp *sfdp;
> @@ -1533,7 +1533,9 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>          * Get a backup of all the parameter to roll back to in case of an
>          * error.
>          */
> -       memcpy(&params, nor->params, sizeof(params));
> +       if (!sv_params)
> +               return -ENOMEM
> +       sv_params[0] = nor->params;
>
>         /* Get the SFDP header. */
>         err = spi_nor_read_sfdp_dma_unsafe(nor, 0, sizeof(header), &header);
> @@ -1653,7 +1655,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>
>         /* Parse optional parameter tables. */
>         for (i = 0; i < header.nph; i++) {
> -               memcpy(&params2, nor->params, sizeof(params2));
> +               sv_params[1] nor->params;

sv_params[1] = nor->params;

-michael

>                 param_header = &param_headers[i];
>
>                 switch (SFDP_PARAM_HEADER_ID(param_header)) {
> @@ -1691,7 +1693,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>                          * spi_nor_flash_parameter data.
>                          */
>                         err = 0;
> -                       memcpy(nor->params, &params2, sizeof(*nor->params));
> +                       nor->params = sv_params[1];
>                 }
>         }
>
> @@ -1712,7 +1714,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
>  free_param_headers:
>         kfree(param_headers);
>         if (err)
> -               memcpy(nor->params, &params, sizeof(*nor->params));
> +               nor->params = sv_params[0];
>
>         return err;
>  }
> --
>
>> 
>> -michael
>> 
>> > Fixes: d20029474a76 ("mtd: spi-nor: push the rollback mechanism into the sfdp module")
>> > Signed-off-by: Arnd Bergmann <arnd@arndb.de>
>> > ---
>> >  drivers/mtd/spi-nor/sfdp.c | 10 +++++++---
>> >  1 file changed, 7 insertions(+), 3 deletions(-)  


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 297 bytes --]

Re: [PATCH] mtd: spi-nor: reduce stack usage in spi_nor_parse_sfdp()

[David Laight]

On Mon, 21 Sep 2026 09:59:24 +0100
David Laight <david.laight.linux@gmail.com> wrote:

> On Mon, 21 Sep 2026 09:55:37 +0200
> "Michael Walle" <mwalle@kernel.org> wrote:
> 
> > Hi Arnd,
> > 
> > On Tue Sep 15, 2026 at 9:40 PM CEST, Arnd Bergmann wrote:  
> > > From: Arnd Bergmann <arnd@arndb.de>
> > >
> > > Two large spi_nor_flash_parameter structures on a function stack
> > > is really too much, and this can exceed an otherwise reasonable
> > > frame limit:
> > >
> > > drivers/mtd/spi-nor/sfdp.c: In function 'spi_nor_parse_sfdp':
> > > drivers/mtd/spi-nor/sfdp.c:1717:1: error: the frame size of 1600 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
> > >
> > > Change one of them to a dynamic allocation to make this more reasonable.    
> > 
> > Thanks for taking care of that. Will you respin the patch with what
> > David suggested?  
> 
> This compiles...

It didn't - I thought I had compiled it :-(
Try:

diff --git a/drivers/mtd/spi-nor/sfdp.c b/drivers/mtd/spi-nor/sfdp.c
index 641f17ad51a0..cec699b52f27 100644
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -1519,9 +1519,9 @@ int spi_nor_check_sfdp_signature(struct spi_nor *nor)
  */
 int spi_nor_parse_sfdp(struct spi_nor *nor)
 {
+       struct spi_nor_flash_parameter *save_params __free(kfree) = kmalloc_objs(*save_params, 2);
        const struct sfdp_parameter_header *param_header, *bfpt_header;
        struct sfdp_parameter_header *param_headers = NULL;
-       struct spi_nor_flash_parameter params, params2;
        struct sfdp_header header;
        struct device *dev = nor->dev;
        struct sfdp *sfdp;
@@ -1533,7 +1533,9 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
         * Get a backup of all the parameter to roll back to in case of an
         * error.
         */
-       memcpy(&params, nor->params, sizeof(params));
+       if (!save_params)
+               return -ENOMEM;
+       save_params[0] = *nor->params;

        /* Get the SFDP header. */
        err = spi_nor_read_sfdp_dma_unsafe(nor, 0, sizeof(header), &header);
@@ -1653,7 +1655,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)

        /* Parse optional parameter tables. */
        for (i = 0; i < header.nph; i++) {
-               memcpy(&params2, nor->params, sizeof(params2));
+               save_params[1] = *nor->params;
                param_header = &param_headers[i];

                switch (SFDP_PARAM_HEADER_ID(param_header)) {
@@ -1691,7 +1693,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
                         * spi_nor_flash_parameter data.
                         */
                        err = 0;
-                       memcpy(nor->params, &params2, sizeof(*nor->params));
+                       *nor->params = save_params[1];
                }
        }

@@ -1712,7 +1714,7 @@ int spi_nor_parse_sfdp(struct spi_nor *nor)
 free_param_headers:
        kfree(param_headers);
        if (err)
-               memcpy(nor->params, &params, sizeof(*nor->params));
+               *nor->params = save_params[0];

        return err;
 }
--

David

...
> > 
> > -michael
> >   
> > > Fixes: d20029474a76 ("mtd: spi-nor: push the rollback mechanism into the sfdp module")
> > > Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> > > ---
> > >  drivers/mtd/spi-nor/sfdp.c | 10 +++++++---
> > >  1 file changed, 7 insertions(+), 3 deletions(-)    
>