Re: [PATCH] spi: imx: fix slab corruption from undersized DMA bounce buffers

[Frank Li <Frank.li@oss.nxp.com>]

On Thu, Oct 15, 2026 at 10:58:00PM +0200, Richard Leitner wrote:
> [You don't often get email from richard.leitner@linux.dev. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> Since commit faa8e404ad8e ("spi: imx: support dynamic burst length for
> ECSPI DMA mode"), the driver allocates its private DMA TX/RX buffers
> with kzalloc(dma_len), where dma_len is only rounded up to 4 bytes, but
> maps, syncs and unmaps them with DMA_CACHE_ALIGNED_LEN(dma_len), i.e.
> rounded up to the cache line size. As a result, the DMA API operates on
> memory beyond the end of the allocation.
>
> This was observed on a custom i.MX8MP platform with an mcp251xfd CAN
> controller under heavy RPMSG load, as a series of refcount_t warnings
> triggered from rpmsg_recv_done() in virtio_rpmsg_bus:
>
>   refcount_t: addition on 0; use-after-free.
>   refcount_t: underflow; use-after-free.
>   refcount_t: saturated; leaking memory.
>
> Leading finally to an "Unable to handle kernel paging request" oops.
> Reproducing this problem took between 30 minutes and roughly 30 hours
> under the same workload.
>
> Hardware watchpoints on the refcount of a struct rpmsg_endpoint showed
> it was overwritten from 2 to 1 by __pi_memcpy_generic() in the
> irq/155-spi2.0 thread. Additionally it was found that a "normal"
> rpmsg_recv_done() took 11µs +/-2µs from its kref_get to kref_put. In
> the error case the same sequence took about 215µs +/-10µs. Based on
> this, an LLM was used to identify the size mismatch fixed here.
>
> Allocate the buffers with DMA_CACHE_ALIGNED_LEN(dma_len) so they cover
> the full mapped length, and use the same length for
> dma_sync_single_for_cpu() to stay consistent with map and unmap.
>
> With this patch applied, the same workload ran for more than 200 hours
> without the problem reproducing.
>
> Assisted-by: LLM
> Fixes: faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode")
> Cc: stable@vger.kernel.org
> Signed-off-by: Richard Leitner <richard.leitner@linux.dev>
> ---

Thanks you fix this.

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/spi/spi-imx.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
> index 79a6c1a60b0a0..3851c50dbe314 100644
> --- a/drivers/spi/spi-imx.c
> +++ b/drivers/spi/spi-imx.c
> @@ -1578,11 +1578,13 @@ static int spi_imx_dma_tx_data_handle(struct spi_imx_data *spi_imx,
>                 dma_data->dma_len = ALIGN(dma_data->data_len, BYTES_PER_32BITS_WORD);
>         }
>
> -       dma_data->dma_tx_buf = kzalloc(dma_data->dma_len, GFP_KERNEL);
> +       dma_data->dma_tx_buf = kzalloc(DMA_CACHE_ALIGNED_LEN(dma_data->dma_len),
> +                                      GFP_KERNEL);
>         if (!dma_data->dma_tx_buf)
>                 return -ENOMEM;
>
> -       dma_data->dma_rx_buf = kzalloc(dma_data->dma_len, GFP_KERNEL);
> +       dma_data->dma_rx_buf = kzalloc(DMA_CACHE_ALIGNED_LEN(dma_data->dma_len),
> +                                      GFP_KERNEL);
>         if (!dma_data->dma_rx_buf) {
>                 kfree(dma_data->dma_tx_buf);
>                 return -ENOMEM;
> @@ -1920,7 +1922,8 @@ static int spi_imx_dma_package_transfer(struct spi_imx_data *spi_imx,
>
>         /* Trim the DMA RX buffer and copy the actual data to rx_buf */
>         dma_sync_single_for_cpu(controller->dma_rx->device->dev, dma_data->dma_rx_addr,
> -                               dma_data->dma_len, DMA_FROM_DEVICE);
> +                               DMA_CACHE_ALIGNED_LEN(dma_data->dma_len),
> +                               DMA_FROM_DEVICE);
>         spi_imx_dma_rx_data_handle(spi_imx, dma_data, transfer->rx_buf + spi_imx->rx_offset,
>                                    word_delay);
>         spi_imx->rx_offset += dma_data->data_len;
>
> ---
> base-commit: 62f482ff73bf3ae88b0c899115527752cf9cbf13
> change-id: 20261015-fix-spi-imx-dma-1bab95ea4863
>
> Best regards,
> --
> Richard Leitner <richard.leitner@linux.dev>
>
>
>