[PATCH v2 0/4] spi: Fix DMA mapping ownership on partial map failure

[PATCH v2 0/4] spi: Fix DMA mapping ownership on partial map failure

[Honghui Jiang]

A partial DMA mapping failure can leave per-transfer mapping flags set
while cur_{tx,rx}_dma_dev are NULL or still refer to the devices used
for an earlier message. The subsequent cleanup may then unmap a
transfer with a NULL or stale device.

Before commit e289df82344f ("spi: Rework per message DMA mapped flag to
be per transfer"), partial-failure handling was already incomplete, but
__spi_unmap_msg() was gated by cur_msg_mapped, which was set only after
the whole message mapped successfully. Earlier mappings could leak, but
cleanup could not unmap them with an unpublished device. The
per-transfer conversion removed that gate: mapping flags can now remain
set while cur_{tx,rx}_dma_dev are still unpublished, turning the leak
into a NULL- or stale-device unmap regression.

Patch 1 publishes the mapping devices before the loop and unwinds every
failure through __spi_unmap_msg(). It keeps the forward declaration so
it is independently buildable and straightforward to backport. Patch 2
then removes the declaration by moving __spi_unmap_msg() above
__spi_map_msg(). Patch 3 clears the current DMA device pointers once the
message has been unmapped, while leaving them intact during partial-map
unwind and DMA-to-PIO fallback. Patch 4 adds the DMA mapping KUnit suite
as a separate translation unit.

Only patch 1 is a stable candidate; patches 2 through 4 are follow-up
cleanup and test changes for mainline.

Testing:

- Patch 1 builds independently with the x86_64 reproducer configuration.
- The spi_dma KUnit suite passes all four cases on x86_64 and UML.
  Moving the DMA device assignments back after the mapping loop makes
  both failure-path cases fail.
- The default and all-tests KUnit configurations both select the suite.
- All four reproducer cases complete without an oops when run as the
  first message, and map/unmap counts are balanced after a successful
  first message.
- After message cleanup, cur_{tx,rx}_dma_dev are NULL.

Changes in v2:

- Explain why e289df82344f changed the partial-failure mode.
- Use plain if (ret) checks in the mapping loop.
- Add separate follow-up patches for the helper relocation and clearing
  stale DMA device pointers.
- Build the KUnit tests as a separate translation unit through the local
  internal header and <kunit/visibility.h>.
- Rename the Kconfig symbol and suite namespace for the DMA subsuite,
  and rename the test file to spi-dma-kunit.c.
- Enable SPI in the default and all-tests KUnit configurations.

v1: https://lore.kernel.org/r/20260805151456.756579-1-jiang_hh2019@163.com

Honghui Jiang (4):
  spi: Fix DMA mapping ownership on partial map failure
  spi: Move __spi_unmap_msg() before __spi_map_msg()
  spi: Clear current DMA devices when unmapping a message
  spi: Add KUnit coverage for DMA mapping error paths

 drivers/spi/.kunitconfig                     |   4 +
 drivers/spi/Kconfig                          |  13 +
 drivers/spi/Makefile                         |   1 +
 drivers/spi/internals.h                      |   9 +-
 drivers/spi/spi.c                            |  91 ++++---
 drivers/spi/tests/Makefile                   |   3 +
 drivers/spi/tests/spi-dma-kunit.c            | 259 +++++++++++++++++++
 tools/testing/kunit/configs/all_tests.config |   1 +
 tools/testing/kunit/configs/default.config   |   1 +
 9 files changed, 340 insertions(+), 42 deletions(-)
 create mode 100644 drivers/spi/.kunitconfig
 create mode 100644 drivers/spi/tests/Makefile
 create mode 100644 drivers/spi/tests/spi-dma-kunit.c


base-commit: 075b74841bd0065a3bda3440873c747938e69b68
-- 
2.43.0

[PATCH v2 1/4] spi: Fix DMA mapping ownership on partial map failure

[Honghui Jiang]

If RX mapping fails after TX mapping succeeds, __spi_map_msg() unmaps
TX but leaves tx_sg_mapped set. If TX mapping fails on a later
transfer, mappings created for earlier transfers remain active.

In both cases, cur_{tx,rx}_dma_dev have not yet been updated because they
are assigned only after every transfer has been mapped. The subsequent
spi_unmap_msg() may therefore unmap the TX mapping again or release
earlier mappings using a NULL or stale device. Using a NULL device can
trigger an oops. An empty SG table does not prevent the NULL dereference
because dma_unmap_sg_attrs() accesses the device before checking the
entry count.

Publish both mapping devices before mapping starts and unwind all
failures through __spi_unmap_msg(). This clears the mapping flags and
releases each mapping once with the device that created it.

Publishing the devices before the loop also refreshes them when no
transfer needs mapping. No mapping flag is set in that case, so current
users do not use the pointers as mapping owners.

Fixes: e289df82344f ("spi: Rework per message DMA mapped flag to be per transfer")
Cc: stable@vger.kernel.org
Signed-off-by: Honghui Jiang <jiang_hh2019@163.com>
---
 drivers/spi/spi.c | 34 ++++++++++++++++++----------------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index d9e6b4b87..12b3a3b29 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1231,6 +1231,8 @@ void spi_unmap_buf(struct spi_controller *ctlr, struct device *dev,
 	spi_unmap_buf_attrs(ctlr, dev, sgt, dir, 0);
 }
 
+static int __spi_unmap_msg(struct spi_controller *ctlr, struct spi_message *msg);
+
 static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
 {
 	struct device *tx_dev, *rx_dev;
@@ -1254,7 +1256,13 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
 	else
 		rx_dev = ctlr->dev.parent;
 
-	ret = -ENOMSG;
+	/*
+	 * Store the devices before mapping so partial failures can be unwound
+	 * with the device that created each mapping.
+	 */
+	ctlr->cur_tx_dma_dev = tx_dev;
+	ctlr->cur_rx_dma_dev = rx_dev;
+
 	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
 		/* The sync is done before each transfer. */
 		unsigned long attrs = DMA_ATTR_SKIP_CPU_SYNC;
@@ -1267,8 +1275,8 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
 						(void *)xfer->tx_buf,
 						xfer->len, DMA_TO_DEVICE,
 						attrs);
-			if (ret != 0)
-				return ret;
+			if (ret)
+				goto unwind;
 
 			xfer->tx_sg_mapped = true;
 		}
@@ -1277,25 +1285,19 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
 			ret = spi_map_buf_attrs(ctlr, rx_dev, &xfer->rx_sg,
 						xfer->rx_buf, xfer->len,
 						DMA_FROM_DEVICE, attrs);
-			if (ret != 0) {
-				spi_unmap_buf_attrs(ctlr, tx_dev,
-						&xfer->tx_sg, DMA_TO_DEVICE,
-						attrs);
-
-				return ret;
-			}
+			if (ret)
+				goto unwind;
 
 			xfer->rx_sg_mapped = true;
 		}
 	}
-	/* No transfer has been mapped, bail out with success */
-	if (ret)
-		return 0;
-
-	ctlr->cur_rx_dma_dev = rx_dev;
-	ctlr->cur_tx_dma_dev = tx_dev;
 
 	return 0;
+
+unwind:
+	__spi_unmap_msg(ctlr, msg);
+
+	return ret;
 }
 
 static int __spi_unmap_msg(struct spi_controller *ctlr, struct spi_message *msg)
-- 
2.43.0

[PATCH v2 2/4] spi: Move __spi_unmap_msg() before __spi_map_msg()

[Honghui Jiang]

Move __spi_unmap_msg() above __spi_map_msg() so the mapping error path
can call it without a forward declaration. This is a code-only
relocation with no functional change.

Suggested-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Honghui Jiang <jiang_hh2019@163.com>
---
 drivers/spi/spi.c | 48 +++++++++++++++++++++++------------------------
 1 file changed, 23 insertions(+), 25 deletions(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 12b3a3b29..96f5058c7 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1231,7 +1231,29 @@ void spi_unmap_buf(struct spi_controller *ctlr, struct device *dev,
 	spi_unmap_buf_attrs(ctlr, dev, sgt, dir, 0);
 }
 
-static int __spi_unmap_msg(struct spi_controller *ctlr, struct spi_message *msg);
+static int __spi_unmap_msg(struct spi_controller *ctlr, struct spi_message *msg)
+{
+	struct device *rx_dev = ctlr->cur_rx_dma_dev;
+	struct device *tx_dev = ctlr->cur_tx_dma_dev;
+	struct spi_transfer *xfer;
+
+	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+		/* The sync has already been done after each transfer. */
+		unsigned long attrs = DMA_ATTR_SKIP_CPU_SYNC;
+
+		if (xfer->rx_sg_mapped)
+			spi_unmap_buf_attrs(ctlr, rx_dev, &xfer->rx_sg,
+					    DMA_FROM_DEVICE, attrs);
+		xfer->rx_sg_mapped = false;
+
+		if (xfer->tx_sg_mapped)
+			spi_unmap_buf_attrs(ctlr, tx_dev, &xfer->tx_sg,
+					    DMA_TO_DEVICE, attrs);
+		xfer->tx_sg_mapped = false;
+	}
+
+	return 0;
+}
 
 static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
 {
@@ -1300,30 +1322,6 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
 	return ret;
 }
 
-static int __spi_unmap_msg(struct spi_controller *ctlr, struct spi_message *msg)
-{
-	struct device *rx_dev = ctlr->cur_rx_dma_dev;
-	struct device *tx_dev = ctlr->cur_tx_dma_dev;
-	struct spi_transfer *xfer;
-
-	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
-		/* The sync has already been done after each transfer. */
-		unsigned long attrs = DMA_ATTR_SKIP_CPU_SYNC;
-
-		if (xfer->rx_sg_mapped)
-			spi_unmap_buf_attrs(ctlr, rx_dev, &xfer->rx_sg,
-					    DMA_FROM_DEVICE, attrs);
-		xfer->rx_sg_mapped = false;
-
-		if (xfer->tx_sg_mapped)
-			spi_unmap_buf_attrs(ctlr, tx_dev, &xfer->tx_sg,
-					    DMA_TO_DEVICE, attrs);
-		xfer->tx_sg_mapped = false;
-	}
-
-	return 0;
-}
-
 static void spi_dma_sync_for_device(struct spi_controller *ctlr,
 				    struct spi_transfer *xfer)
 {
-- 
2.43.0

[PATCH v2 3/4] spi: Clear current DMA devices when unmapping a message

[Honghui Jiang]

The current DMA device pointers remain set after a message has been
unmapped. Existing users either check the corresponding mapped flag or
access the pointers before finalizing the message, but retaining stale
device pointers is fragile.

Clear both pointers in spi_unmap_msg() after the internal unmap
completes. Keep them intact in __spi_unmap_msg(), since that helper is
also used during partial-map unwind and the in-message DMA-to-PIO
fallback, before processing of the current message is complete.

Suggested-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Honghui Jiang <jiang_hh2019@163.com>
---
 drivers/spi/spi.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 96f5058c7..e5b1531b9 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1373,6 +1373,7 @@ static inline int spi_unmap_msg(struct spi_controller *ctlr,
 				struct spi_message *msg)
 {
 	struct spi_transfer *xfer;
+	int ret;
 
 	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
 		/*
@@ -1385,7 +1386,12 @@ static inline int spi_unmap_msg(struct spi_controller *ctlr,
 			xfer->rx_buf = NULL;
 	}
 
-	return __spi_unmap_msg(ctlr, msg);
+	ret = __spi_unmap_msg(ctlr, msg);
+
+	ctlr->cur_rx_dma_dev = NULL;
+	ctlr->cur_tx_dma_dev = NULL;
+
+	return ret;
 }
 
 static int spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
-- 
2.43.0

[PATCH v2 4/4] spi: Add KUnit coverage for DMA mapping error paths

[Honghui Jiang]

Add KUnit tests for the __spi_map_msg() error paths. The tests verify
that a later TX or RX mapping failure clears the mapping state of
earlier transfers and leaves cur_{tx,rx}_dma_dev identifying the
current mapping device.

A zero-length transfer causes sg_alloc_table() to return -EINVAL,
providing deterministic failure injection without test hooks.
Additional cases cover successful map/unmap and a message which
requires no mapping.

Build the DMA suite as a separate translation unit, exposing the two
internal mapping helpers only for KUnit through the local internal
header. Enable SPI in the default and all-tests KUnit configurations so
the suite is exercised there.

Signed-off-by: Honghui Jiang <jiang_hh2019@163.com>
---
 drivers/spi/.kunitconfig                     |   4 +
 drivers/spi/Kconfig                          |  13 +
 drivers/spi/Makefile                         |   1 +
 drivers/spi/internals.h                      |   9 +-
 drivers/spi/spi.c                            |   9 +-
 drivers/spi/tests/Makefile                   |   3 +
 drivers/spi/tests/spi-dma-kunit.c            | 259 +++++++++++++++++++
 tools/testing/kunit/configs/all_tests.config |   1 +
 tools/testing/kunit/configs/default.config   |   1 +
 9 files changed, 296 insertions(+), 4 deletions(-)
 create mode 100644 drivers/spi/.kunitconfig
 create mode 100644 drivers/spi/tests/Makefile
 create mode 100644 drivers/spi/tests/spi-dma-kunit.c

diff --git a/drivers/spi/.kunitconfig b/drivers/spi/.kunitconfig
new file mode 100644
index 000000000..07fa092c8
--- /dev/null
+++ b/drivers/spi/.kunitconfig
@@ -0,0 +1,4 @@
+CONFIG_KUNIT=y
+CONFIG_SPI=y
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_DMA_KUNIT_TEST=y
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 8782514bb..74382c31e 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -1360,6 +1360,19 @@ config SPI_SPIDEV
 	help
 	  This supports user mode SPI protocol drivers.
 
+config SPI_DMA_KUNIT_TEST
+	tristate "KUnit tests for SPI core DMA mapping" if !KUNIT_ALL_TESTS
+	depends on KUNIT && HAS_DMA
+	default KUNIT_ALL_TESTS
+	help
+	  Build KUnit tests for SPI core DMA mapping. The tests exercise
+	  partial TX and RX mapping failures, verify that the mapping state is
+	  unwound, and check that the current DMA devices identify the owner of
+	  those mappings when the error is returned. They also cover a
+	  successful mapping and a message which requires no mapping.
+
+	  If unsure say N.
+
 config SPI_LOOPBACK_TEST
 	tristate "spi loopback test framework support"
 	depends on m
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index 9fa12498c..f693699f8 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -13,6 +13,7 @@ obj-$(CONFIG_SPI_MUX)			+= spi-mux.o
 obj-$(CONFIG_SPI_OFFLOAD)		+= spi-offload.o
 obj-$(CONFIG_SPI_SPIDEV)		+= spidev.o
 obj-$(CONFIG_SPI_LOOPBACK_TEST)		+= spi-loopback-test.o
+obj-$(CONFIG_SPI_DMA_KUNIT_TEST)	+= tests/
 
 # SPI master controller drivers (bus)
 obj-$(CONFIG_SPI_AIROHA_SNFI)		+= spi-airoha-snfi.o
diff --git a/drivers/spi/internals.h b/drivers/spi/internals.h
index 1f459b895..c56c190b0 100644
--- a/drivers/spi/internals.h
+++ b/drivers/spi/internals.h
@@ -5,8 +5,8 @@
  *
  * Author: Boris Brezillon <boris.brezillon@bootlin.com>
  *
- * Helpers needed by the spi or spi-mem logic. Should not be used outside of
- * spi-mem.c and spi.c.
+ * Helpers needed by the SPI core and its tests. Should not be used outside
+ * drivers/spi/.
  */
 
 #ifndef __LINUX_SPI_INTERNALS_H
@@ -20,6 +20,11 @@
 void spi_flush_queue(struct spi_controller *ctrl);
 
 #ifdef CONFIG_HAS_DMA
+#if IS_ENABLED(CONFIG_KUNIT)
+int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg);
+int __spi_unmap_msg(struct spi_controller *ctlr, struct spi_message *msg);
+#endif
+
 int spi_map_buf(struct spi_controller *ctlr, struct device *dev,
 		struct sg_table *sgt, void *buf, size_t len,
 		enum dma_data_direction dir);
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index e5b1531b9..6be7987ed 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -4,6 +4,7 @@
 // Copyright (C) 2005 David Brownell
 // Copyright (C) 2008 Secret Lab Technologies Ltd.
 
+#include <kunit/visibility.h>
 #include <linux/acpi.h>
 #include <linux/cache.h>
 #include <linux/clk/clk-conf.h>
@@ -1231,7 +1232,8 @@ void spi_unmap_buf(struct spi_controller *ctlr, struct device *dev,
 	spi_unmap_buf_attrs(ctlr, dev, sgt, dir, 0);
 }
 
-static int __spi_unmap_msg(struct spi_controller *ctlr, struct spi_message *msg)
+VISIBLE_IF_KUNIT
+int __spi_unmap_msg(struct spi_controller *ctlr, struct spi_message *msg)
 {
 	struct device *rx_dev = ctlr->cur_rx_dma_dev;
 	struct device *tx_dev = ctlr->cur_tx_dma_dev;
@@ -1254,8 +1256,10 @@ static int __spi_unmap_msg(struct spi_controller *ctlr, struct spi_message *msg)
 
 	return 0;
 }
+EXPORT_SYMBOL_IF_KUNIT(__spi_unmap_msg);
 
-static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
+VISIBLE_IF_KUNIT
+int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
 {
 	struct device *tx_dev, *rx_dev;
 	struct spi_transfer *xfer;
@@ -1321,6 +1325,7 @@ static int __spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
 
 	return ret;
 }
+EXPORT_SYMBOL_IF_KUNIT(__spi_map_msg);
 
 static void spi_dma_sync_for_device(struct spi_controller *ctlr,
 				    struct spi_transfer *xfer)
diff --git a/drivers/spi/tests/Makefile b/drivers/spi/tests/Makefile
new file mode 100644
index 000000000..26689e0cb
--- /dev/null
+++ b/drivers/spi/tests/Makefile
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+obj-$(CONFIG_SPI_DMA_KUNIT_TEST) += spi-dma-kunit.o
diff --git a/drivers/spi/tests/spi-dma-kunit.c b/drivers/spi/tests/spi-dma-kunit.c
new file mode 100644
index 000000000..ee5476ff3
--- /dev/null
+++ b/drivers/spi/tests/spi-dma-kunit.c
@@ -0,0 +1,259 @@
+// SPDX-License-Identifier: GPL-2.0
+// KUnit tests for the SPI core DMA mapping error paths.
+//
+// A mapping error must clear all SG tables and *_sg_mapped flags while
+// cur_{tx,rx}_dma_dev identify the devices used for the attempted mapping.
+// Zero-length transfers make sg_alloc_table() fail with -EINVAL, providing
+// deterministic failure injection without test hooks.
+
+#include <kunit/device.h>
+#include <kunit/test.h>
+#include <linux/dma-mapping.h>
+#include <linux/limits.h>
+#include <linux/spi/spi.h>
+
+#include "../internals.h"
+
+MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING");
+
+#define SPI_DMA_TEST_LEN		256
+#define SPI_DMA_TEST_XFERS		2
+
+struct spi_dma_test_ctx {
+	struct spi_controller	*ctlr;
+	struct spi_device	*spi;
+	struct device		*dma_dev;
+	struct device		*stale_dma_dev;
+	struct spi_transfer	xfer[SPI_DMA_TEST_XFERS];
+	struct spi_message	msg;
+	void			*buf[SPI_DMA_TEST_XFERS * 2];
+};
+
+static bool spi_dma_test_can_dma(struct spi_controller *ctlr,
+				 struct spi_device *spi,
+				 struct spi_transfer *xfer)
+{
+	/* Opt every transfer into the core DMA mapping path. */
+	return true;
+}
+
+/*
+ * A bare controller is sufficient because the mapping helpers do not
+ * dereference ctlr->dev. With dma_tx and dma_rx unset, both directions use
+ * dma_map_dev, so the controller need not be registered.
+ */
+static struct spi_dma_test_ctx *spi_dma_test_ctx_new(struct kunit *test)
+{
+	struct spi_dma_test_ctx *ctx;
+
+	ctx = kunit_kzalloc(test, sizeof(*ctx), GFP_KERNEL);
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
+
+	ctx->dma_dev = kunit_device_register(test, "spi-dma-error-path");
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx->dma_dev);
+	ctx->stale_dma_dev =
+		kunit_device_register(test, "spi-dma-stale-device");
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx->stale_dma_dev);
+
+	/* Keep both devices valid if an assertion aborts the test. */
+	KUNIT_ASSERT_EQ(test, 0,
+			dma_coerce_mask_and_coherent(ctx->dma_dev,
+						     DMA_BIT_MASK(64)));
+	KUNIT_ASSERT_EQ(test, 0,
+			dma_coerce_mask_and_coherent(ctx->stale_dma_dev,
+						     DMA_BIT_MASK(64)));
+
+	ctx->ctlr = kunit_kzalloc(test, sizeof(*ctx->ctlr), GFP_KERNEL);
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx->ctlr);
+
+	ctx->spi = kunit_kzalloc(test, sizeof(*ctx->spi), GFP_KERNEL);
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx->spi);
+
+	ctx->ctlr->can_dma = spi_dma_test_can_dma;
+	ctx->ctlr->dma_map_dev = ctx->dma_dev;
+	/* Normally initialized by spi_register_controller(). */
+	ctx->ctlr->max_dma_len = INT_MAX;
+
+	ctx->spi->controller = ctx->ctlr;
+	spi_message_init(&ctx->msg);
+	ctx->msg.spi = ctx->spi;
+
+	return ctx;
+}
+
+static void *spi_dma_test_buf(struct kunit *test, struct spi_dma_test_ctx *ctx,
+			      unsigned int slot)
+{
+	KUNIT_ASSERT_LT(test, slot, ARRAY_SIZE(ctx->buf));
+
+	ctx->buf[slot] = kunit_kzalloc(test, SPI_DMA_TEST_LEN, GFP_KERNEL);
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx->buf[slot]);
+
+	return ctx->buf[slot];
+}
+
+/*
+ * Emulate DMA devices retained from an earlier message. Using valid devices
+ * also lets the unfixed path reach the assertions instead of dereferencing
+ * NULL during cleanup.
+ */
+static void spi_dma_test_pin_stale_dma_devs(struct spi_dma_test_ctx *ctx)
+{
+	ctx->ctlr->cur_tx_dma_dev = ctx->stale_dma_dev;
+	ctx->ctlr->cur_rx_dma_dev = ctx->stale_dma_dev;
+}
+
+static void spi_dma_test_assert_dma_devs_published(struct kunit *test,
+						   struct spi_dma_test_ctx *ctx)
+{
+	KUNIT_ASSERT_PTR_EQ(test, ctx->ctlr->cur_tx_dma_dev, ctx->dma_dev);
+	KUNIT_ASSERT_PTR_EQ(test, ctx->ctlr->cur_rx_dma_dev, ctx->dma_dev);
+}
+
+static void spi_dma_test_assert_nothing_mapped(struct kunit *test,
+					       struct spi_dma_test_ctx *ctx,
+					       unsigned int nr_xfers)
+{
+	unsigned int i;
+
+	for (i = 0; i < nr_xfers; i++) {
+		KUNIT_ASSERT_FALSE_MSG(test, ctx->xfer[i].tx_sg_mapped,
+				       "xfer[%u] still claims a TX mapping after __spi_map_msg() failed",
+				       i);
+		KUNIT_ASSERT_FALSE_MSG(test, ctx->xfer[i].rx_sg_mapped,
+				       "xfer[%u] still claims an RX mapping after __spi_map_msg() failed",
+				       i);
+		KUNIT_EXPECT_NULL(test, ctx->xfer[i].tx_sg.sgl);
+		KUNIT_EXPECT_EQ(test, ctx->xfer[i].tx_sg.orig_nents, 0U);
+		KUNIT_EXPECT_EQ(test, ctx->xfer[i].tx_sg.nents, 0U);
+		KUNIT_EXPECT_NULL(test, ctx->xfer[i].rx_sg.sgl);
+		KUNIT_EXPECT_EQ(test, ctx->xfer[i].rx_sg.orig_nents, 0U);
+		KUNIT_EXPECT_EQ(test, ctx->xfer[i].rx_sg.nents, 0U);
+	}
+}
+
+/*
+ * xfer0 maps TX and RX; zero-length xfer1 then fails its TX mapping.
+ * The failure must unwind xfer0 and update cur_*_dma_dev.
+ */
+static void spi_dma_later_tx_fail_rolls_back_earlier(struct kunit *test)
+{
+	struct spi_dma_test_ctx *ctx = spi_dma_test_ctx_new(test);
+	int ret;
+
+	ctx->xfer[0].tx_buf = spi_dma_test_buf(test, ctx, 0);
+	ctx->xfer[0].rx_buf = spi_dma_test_buf(test, ctx, 1);
+	ctx->xfer[0].len = SPI_DMA_TEST_LEN;
+
+	ctx->xfer[1].tx_buf = spi_dma_test_buf(test, ctx, 2);
+	ctx->xfer[1].rx_buf = NULL;
+	ctx->xfer[1].len = 0;			/* forces -EINVAL */
+
+	spi_message_add_tail(&ctx->xfer[0], &ctx->msg);
+	spi_message_add_tail(&ctx->xfer[1], &ctx->msg);
+
+	spi_dma_test_pin_stale_dma_devs(ctx);
+
+	ret = __spi_map_msg(ctx->ctlr, &ctx->msg);
+	KUNIT_ASSERT_EQ(test, ret, -EINVAL);
+
+	spi_dma_test_assert_dma_devs_published(test, ctx);
+	spi_dma_test_assert_nothing_mapped(test, ctx, SPI_DMA_TEST_XFERS);
+
+	KUNIT_EXPECT_EQ(test, 0, __spi_unmap_msg(ctx->ctlr, &ctx->msg));
+}
+
+/*
+ * xfer0 maps TX and RX; zero-length RX-only xfer1 then fails.
+ * The failure must unwind xfer0 without leaving either mapping flag set.
+ */
+static void spi_dma_later_rx_fail_rolls_back_earlier(struct kunit *test)
+{
+	struct spi_dma_test_ctx *ctx = spi_dma_test_ctx_new(test);
+	int ret;
+
+	ctx->xfer[0].tx_buf = spi_dma_test_buf(test, ctx, 0);
+	ctx->xfer[0].rx_buf = spi_dma_test_buf(test, ctx, 1);
+	ctx->xfer[0].len = SPI_DMA_TEST_LEN;
+
+	ctx->xfer[1].tx_buf = NULL;
+	ctx->xfer[1].rx_buf = spi_dma_test_buf(test, ctx, 2);
+	ctx->xfer[1].len = 0;			/* forces -EINVAL */
+
+	spi_message_add_tail(&ctx->xfer[0], &ctx->msg);
+	spi_message_add_tail(&ctx->xfer[1], &ctx->msg);
+
+	spi_dma_test_pin_stale_dma_devs(ctx);
+
+	ret = __spi_map_msg(ctx->ctlr, &ctx->msg);
+	KUNIT_ASSERT_EQ(test, ret, -EINVAL);
+
+	spi_dma_test_assert_dma_devs_published(test, ctx);
+	spi_dma_test_assert_nothing_mapped(test, ctx, SPI_DMA_TEST_XFERS);
+
+	KUNIT_EXPECT_EQ(test, 0, __spi_unmap_msg(ctx->ctlr, &ctx->msg));
+}
+
+/* Ensure the error unwind does not affect successful mappings. */
+static void spi_dma_map_success_publishes_dma_devs(struct kunit *test)
+{
+	struct spi_dma_test_ctx *ctx = spi_dma_test_ctx_new(test);
+	int ret;
+
+	ctx->xfer[0].tx_buf = spi_dma_test_buf(test, ctx, 0);
+	ctx->xfer[0].rx_buf = spi_dma_test_buf(test, ctx, 1);
+	ctx->xfer[0].len = SPI_DMA_TEST_LEN;
+
+	spi_message_add_tail(&ctx->xfer[0], &ctx->msg);
+
+	ret = __spi_map_msg(ctx->ctlr, &ctx->msg);
+	KUNIT_ASSERT_EQ(test, ret, 0);
+
+	KUNIT_EXPECT_TRUE(test, ctx->xfer[0].tx_sg_mapped);
+	KUNIT_EXPECT_TRUE(test, ctx->xfer[0].rx_sg_mapped);
+	KUNIT_EXPECT_PTR_EQ(test, ctx->ctlr->cur_tx_dma_dev, ctx->dma_dev);
+	KUNIT_EXPECT_PTR_EQ(test, ctx->ctlr->cur_rx_dma_dev, ctx->dma_dev);
+
+	KUNIT_EXPECT_EQ(test, 0, __spi_unmap_msg(ctx->ctlr, &ctx->msg));
+
+	KUNIT_EXPECT_FALSE(test, ctx->xfer[0].tx_sg_mapped);
+	KUNIT_EXPECT_FALSE(test, ctx->xfer[0].rx_sg_mapped);
+	KUNIT_EXPECT_NULL(test, ctx->xfer[0].tx_sg.sgl);
+	KUNIT_EXPECT_NULL(test, ctx->xfer[0].rx_sg.sgl);
+}
+
+/* A transfer without buffers requires no DMA mapping. */
+static void spi_dma_map_nothing_is_success(struct kunit *test)
+{
+	struct spi_dma_test_ctx *ctx = spi_dma_test_ctx_new(test);
+	int ret;
+
+	ctx->xfer[0].tx_buf = NULL;
+	ctx->xfer[0].rx_buf = NULL;
+	ctx->xfer[0].len = SPI_DMA_TEST_LEN;
+
+	spi_message_add_tail(&ctx->xfer[0], &ctx->msg);
+
+	ret = __spi_map_msg(ctx->ctlr, &ctx->msg);
+	KUNIT_EXPECT_EQ(test, ret, 0);
+
+	spi_dma_test_assert_nothing_mapped(test, ctx, 1);
+}
+
+static struct kunit_case spi_dma_error_path_cases[] = {
+	KUNIT_CASE(spi_dma_later_tx_fail_rolls_back_earlier),
+	KUNIT_CASE(spi_dma_later_rx_fail_rolls_back_earlier),
+	KUNIT_CASE(spi_dma_map_success_publishes_dma_devs),
+	KUNIT_CASE(spi_dma_map_nothing_is_success),
+	{}
+};
+
+static struct kunit_suite spi_dma_error_path_suite = {
+	.name = "spi_dma",
+	.test_cases = spi_dma_error_path_cases,
+};
+
+kunit_test_suite(spi_dma_error_path_suite);
+
+MODULE_DESCRIPTION("KUnit tests for SPI core DMA mapping");
+MODULE_LICENSE("GPL");
diff --git a/tools/testing/kunit/configs/all_tests.config b/tools/testing/kunit/configs/all_tests.config
index bccc2c771..7bdcbdec2 100644
--- a/tools/testing/kunit/configs/all_tests.config
+++ b/tools/testing/kunit/configs/all_tests.config
@@ -21,6 +21,7 @@ CONFIG_VFAT_FS=y
 CONFIG_PCI=y
 CONFIG_USB4=y
 CONFIG_I2C=y
+CONFIG_SPI=y
 
 CONFIG_NET=y
 CONFIG_MCTP=y
diff --git a/tools/testing/kunit/configs/default.config b/tools/testing/kunit/configs/default.config
index e67af7b9f..2f24147c9 100644
--- a/tools/testing/kunit/configs/default.config
+++ b/tools/testing/kunit/configs/default.config
@@ -1,3 +1,4 @@
 CONFIG_KUNIT=y
 CONFIG_KUNIT_EXAMPLE_TEST=y
 CONFIG_KUNIT_ALL_TESTS=y
+CONFIG_SPI=y
-- 
2.43.0

Re: [PATCH v2 4/4] spi: Add KUnit coverage for DMA mapping error paths

[Andy Shevchenko]

On Fri, Aug 14, 2026 at 11:14:18AM +0800, Honghui Jiang wrote:
> Add KUnit tests for the __spi_map_msg() error paths. The tests verify
> that a later TX or RX mapping failure clears the mapping state of
> earlier transfers and leaves cur_{tx,rx}_dma_dev identifying the
> current mapping device.
> 
> A zero-length transfer causes sg_alloc_table() to return -EINVAL,
> providing deterministic failure injection without test hooks.
> Additional cases cover successful map/unmap and a message which
> requires no mapping.
> 
> Build the DMA suite as a separate translation unit, exposing the two
> internal mapping helpers only for KUnit through the local internal
> header. Enable SPI in the default and all-tests KUnit configurations so
> the suite is exercised there.

...

> +++ b/tools/testing/kunit/configs/default.config
> @@ -1,3 +1,4 @@
>  CONFIG_KUNIT=y
>  CONFIG_KUNIT_EXAMPLE_TEST=y
>  CONFIG_KUNIT_ALL_TESTS=y
> +CONFIG_SPI=y

This is a stray change.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2 4/4] spi: Add KUnit coverage for DMA mapping error paths

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 430 bytes --]

On Fri, Aug 14, 2026 at 03:27:13PM +0300, Andy Shevchenko wrote:
> On Fri, Aug 14, 2026 at 11:14:18AM +0800, Honghui Jiang wrote:

> > +++ b/tools/testing/kunit/configs/default.config
> > @@ -1,3 +1,4 @@
> >  CONFIG_KUNIT=y
> >  CONFIG_KUNIT_EXAMPLE_TEST=y
> >  CONFIG_KUNIT_ALL_TESTS=y
> > +CONFIG_SPI=y

> This is a stray change.

Well, one of the config changes is.  Clearly spi is critical enough to
be tested by default!  :P

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH v2 4/4] spi: Add KUnit coverage for DMA mapping error paths

[Honghui Jiang]

On Fri, Aug 14, 2026 at 01:49:50PM +0100, Mark Brown wrote:
> On Fri, Aug 14, 2026 at 03:27:13PM +0300, Andy Shevchenko wrote:
> > This is a stray change.
>
> Well, one of the config changes is.  Clearly spi is critical enough to
> be tested by default!  :P


Thanks, both. I'll drop CONFIG_SPI=y from default.config in v3 and keep
it in all_tests.config.

Re: [PATCH v2 4/4] spi: Add KUnit coverage for DMA mapping error paths

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 421 bytes --]

On Sat, Aug 15, 2026 at 01:38:11AM +0800, Honghui  Jiang wrote:
> On Fri, Aug 14, 2026 at 01:49:50PM +0100, Mark Brown wrote:

> > Well, one of the config changes is.  Clearly spi is critical enough to
> > be tested by default!  :P

> Thanks, both. I'll drop CONFIG_SPI=y from default.config in v3 and keep
> it in all_tests.config.

It's OK, I deleted the extra change locally - no need to resend unless
my CI blows up.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH v2 4/4] spi: Add KUnit coverage for DMA mapping error paths

[David Gow]

Le 15/08/2026 à 1:38 AM, Honghui Jiang a écrit :
> On Fri, Aug 14, 2026 at 01:49:50PM +0100, Mark Brown wrote:
>> On Fri, Aug 14, 2026 at 03:27:13PM +0300, Andy Shevchenko wrote:
>>> This is a stray change.
>>
>> Well, one of the config changes is.  Clearly spi is critical enough to
>> be tested by default!  :P
> 
> 
> Thanks, both. I'll drop CONFIG_SPI=y from default.config in v3 and keep
> it in all_tests.config.
> 

Thanks: we want to keep the default config to only match things
otherwise enabled in Kconfig (via CONFIG_KUNIT_ALL_TESTS=y).
all_tests.config is the right place for this.

Cheers,
-- David

Re: [PATCH v2 0/4] spi: Fix DMA mapping ownership on partial map failure

[Andy Shevchenko]

On Fri, Aug 14, 2026 at 11:14:14AM +0800, Honghui Jiang wrote:
> A partial DMA mapping failure can leave per-transfer mapping flags set
> while cur_{tx,rx}_dma_dev are NULL or still refer to the devices used
> for an earlier message. The subsequent cleanup may then unmap a
> transfer with a NULL or stale device.
> 
> Before commit e289df82344f ("spi: Rework per message DMA mapped flag to
> be per transfer"), partial-failure handling was already incomplete, but
> __spi_unmap_msg() was gated by cur_msg_mapped, which was set only after
> the whole message mapped successfully. Earlier mappings could leak, but
> cleanup could not unmap them with an unpublished device. The
> per-transfer conversion removed that gate: mapping flags can now remain
> set while cur_{tx,rx}_dma_dev are still unpublished, turning the leak
> into a NULL- or stale-device unmap regression.
> 
> Patch 1 publishes the mapping devices before the loop and unwinds every
> failure through __spi_unmap_msg(). It keeps the forward declaration so
> it is independently buildable and straightforward to backport. Patch 2
> then removes the declaration by moving __spi_unmap_msg() above
> __spi_map_msg(). Patch 3 clears the current DMA device pointers once the
> message has been unmapped, while leaving them intact during partial-map
> unwind and DMA-to-PIO fallback. Patch 4 adds the DMA mapping KUnit suite
> as a separate translation unit.
> 
> Only patch 1 is a stable candidate; patches 2 through 4 are follow-up
> cleanup and test changes for mainline.
> 
> Testing:
> 
> - Patch 1 builds independently with the x86_64 reproducer configuration.
> - The spi_dma KUnit suite passes all four cases on x86_64 and UML.
>   Moving the DMA device assignments back after the mapping loop makes
>   both failure-path cases fail.
> - The default and all-tests KUnit configurations both select the suite.
> - All four reproducer cases complete without an oops when run as the
>   first message, and map/unmap counts are balanced after a successful
>   first message.
> - After message cleanup, cur_{tx,rx}_dma_dev are NULL.

Nice series!
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
with a caveat that there is one stray change in the last patch.
Assumed that in v3 it will be dropped.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2 0/4] spi: Fix DMA mapping ownership on partial map failure

[Mark Brown]

On Fri, 14 Aug 2026 11:14:14 +0800, Honghui Jiang wrote:
> spi: Fix DMA mapping ownership on partial map failure
> 
> A partial DMA mapping failure can leave per-transfer mapping flags set
> while cur_{tx,rx}_dma_dev are NULL or still refer to the devices used
> for an earlier message. The subsequent cleanup may then unmap a
> transfer with a NULL or stale device.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-7.3

Thanks!

[1/4] spi: Fix DMA mapping ownership on partial map failure
      https://git.kernel.org/broonie/spi/c/367cea239fc9
[2/4] spi: Move __spi_unmap_msg() before __spi_map_msg()
      https://git.kernel.org/broonie/spi/c/b82b2dfc93d3
[3/4] spi: Clear current DMA devices when unmapping a message
      https://git.kernel.org/broonie/spi/c/af6aaacd42f7
[4/4] spi: Add KUnit coverage for DMA mapping error paths
      https://git.kernel.org/broonie/spi/c/9b81a87c5244

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark