spi: axi-spi-engine: Start the program length at zero
Subsystems (3)
PATCH 1/1 spi: axi-spi-engine: Start the program length at zero
spi_engine_optimize_message() allocates the program with kzalloc_flex(), which sets the __counted_by() counter "length" to the allocated size when the compiler supports __builtin_counted_by_ref(). The program is then filled by spi_engine_program_add_cmd(), which increments "length" and stores at length - 1, expecting it to start at zero as it did when the program came from kzalloc().
Reset "length" after the allocation, since it is a "usage" counter, not a "total allocation" counter.
Build tested ARCH=x86_64 defconfig with CONFIG_SPI_AXI_SPI_ENGINE=m and W=1, with GCC 16.2.0.
Reported-by Dennis Gilmore <[email protected]>
Fixes 69050f8d6d075 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types")
Signed-off-by Kees Cook <[email protected]>
--- drivers/spi/spi-axi-spi-engine.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-axi-spi-engine.c +2 -0
@@ -818,6 +818,8 @@ static int spi_engine_optimize_message(struct spi_message *msg) p =kzalloc_flex (*p, instructions, p_dry.length +1 );if (!p)return -ENOMEM ; +/* spi_engine_program_add_cmd() counts the instructions as it adds them. */ + p->length =0 ;spi_engine_compile_message (msg, false, p);
Signature · 1 line
2.55.0