[PATCH] spi: axi-spi-engine: Start the program length at zero

[Kees Cook <kees@kernel.org>]

spi_engine_optimize_message() allocates the program with kzalloc_flex(),
which sets the __counted_by() counter "length" to the allocated size when
the compiler supports __builtin_counted_by_ref(). The program is then
filled by spi_engine_program_add_cmd(), which increments "length" and
stores at length - 1, expecting it to start at zero as it did when the
program came from kzalloc().

Reset "length" after the allocation, since it is a "usage" counter, not
a "total allocation" counter.

Build tested ARCH=x86_64 defconfig with CONFIG_SPI_AXI_SPI_ENGINE=m and
W=1, with GCC 16.2.0.

Reported-by: Dennis Gilmore <dennis@ausil.us>
Closes: https://lore.kernel.org/all/20261112025252.71375-1-dennis@ausil.us/
Fixes: 69050f8d6d075 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
---
 drivers/spi/spi-axi-spi-engine.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-axi-spi-engine.c b/drivers/spi/spi-axi-spi-engine.c
index ead5b295e680..9cfee409f15c 100644
--- a/drivers/spi/spi-axi-spi-engine.c
+++ b/drivers/spi/spi-axi-spi-engine.c
@@ -818,6 +818,8 @@ static int spi_engine_optimize_message(struct spi_message *msg)
 	p = kzalloc_flex(*p, instructions, p_dry.length + 1);
 	if (!p)
 		return -ENOMEM;
+	/* spi_engine_program_add_cmd() counts the instructions as it adds them. */
+	p->length = 0;
 
 	spi_engine_compile_message(msg, false, p);
 
-- 
2.55.0