From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794063431; b=NBkG+XQmMAvaReoGPONQrHqFC+dWtU6IHi64Ukx5zGzc9Oba72Yy8VrY492+KEhnYW3X vRgs2hHpk46W9ja1aOHRjTpyypfIqd3MmzrfTiQZ4il+DbwcotrumLIHISLs4/Q0jAdO+ b/q/YLhWGkgKXQ2uMij/GBjgfeJUHTTr59CDyNbygelK/b2tbgc5eoBE37ylsQZUZgpFT cPmQEBQi9KDDn1BLLIj17Som9BRyhaj4pJMy84E89vVADgRtMg7mJzgasuh9qgqJ+bko4 xGXilgaf/heeQdT+nFCTwZjyRQjBgCS/7JnRZfnbzX1xbo9a6k0YJ7MjYizK/bNeurg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794063431; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=VaozzPD8IRRdKfRR61D/DwsEzYnHN2dyceXc1dT/XGo=; b=CRvN8VRon6HduUyuB+dqk1W7yZb9r2eussp2TveXwdrGaTNMp/z2MvW2m0pxaxNEYLsq aAuCvvDmdb2LwbixU1cRZDiURmXAj/dPSjA6c4zTuUNnxd4qmV9RTEUuwACuPSWabrv2Y nOUsbIEGOodztqsx00h9NclUyAFoziWFShTujk4PTGYxG073h6ZXUA2TJ/eKndacbJ/nk ydKca50tiaQF8ay5JtCo3zEr4spVrzGfP8AD05n/pwSCMsozH8/5s5rNcz5d/g/JQAWV9 86ONBR+U/A9lFOaG5N4LjiD6DC+p3tZM94E5Zs5DlDa71LU5GmANFtcYqL4eAWC3KdQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="Z/i5wLyp"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 97EC6606D801; Sat, 7 Nov 2026 14:57:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Z/i5wLyp Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4197D1F008A1; Sat, 7 Nov 2026 14:57:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794063431; bh=VaozzPD8IRRdKfRR61D/DwsEzYnHN2dyceXc1dT/XGo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Z/i5wLypoX/mVIaTpNxqoDQ3RhwgXJjAPKmWfnB+j+UyZUQjPQxnhCG/1EiuPGlKn 6unQ99zK9oL2APs5ZmNbivDtomj+2jxpWMr0MP59rIwj9k6kM/5xnkxcMsPd8R8eOd k/RFErExqTrAuURkVO1YXVgegjiaXu/sPhErapk0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Guanglei Zhu , Weibin Liu , Mark Brown , Sasha Levin Subject: [PATCH 6.18 595/869] spi: amd: fix len==0 underflow and FIFO overflow Date: Sat, 7 Nov 2026 08:54:37 -0500 Message-ID: <20261107134913.267377136@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134852.069646174@linuxfoundation.org> References: <20261107134852.069646174@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Weibin Liu [ Upstream commit e2f4edfc061e493fddde16c4bbe1c4f230f41e4a ] amd_spi_fifo_xfer() unconditionally decrements xfer->len when a tx_buf is present. The SPI core does not reject zero-length transfers, so a transfer submitted through the SPI_IOC_MESSAGE ioctl with len == 0 and a tx_buf makes the u32 len wrap to 0xFFFFFFFF, and the following per-byte loop writes far past the FIFO window. The driver also never checks the cumulative FIFO offset against AMD_SPI_FIFO_SIZE. The core splits each transfer down to the controller's max transfer size but does not bound the total message length, so a message of several transfers whose total exceeds the FIFO overflows it with out-of-bounds MMIO writes (tx) and reads (rx). Skip zero-length transfers and reject any transfer that would run past the end of the FIFO window. Tested with a user-space replica of the fifo_xfer length arithmetic (ASAN build): a zero-length transfer with tx_buf makes len-- wrap to 0xffffffff, and skipping zero-length transfers avoids the wrap. No AMD SPI hardware was available, so the FIFO bound check was verified by inspection against AMD_SPI_FIFO_SIZE. Fixes: bbb336f39efc ("spi: spi-amd: Add AMD SPI controller driver support") Cc: stable@vger.kernel.org # 5.8+ Reviewed-by: Guanglei Zhu Signed-off-by: Weibin Liu Link: https://patch.msgid.link/20261014-spi-amd-fifo-fix-v1-1-9fec9ab753e8@xiaopeng.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin --- drivers/spi/spi-amd.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/spi/spi-amd.c b/drivers/spi/spi-amd.c index 71a6e5c475b03..ddf89e5353c55 100644 --- a/drivers/spi/spi-amd.c +++ b/drivers/spi/spi-amd.c @@ -322,11 +322,22 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi, list_for_each_entry(xfer, &message->transfers, transfer_list) { + /* Skip zero-length transfers to avoid len underflow below */ + if (!xfer->len) + continue; + if (xfer->speed_hz) amd_set_spi_freq(amd_spi, xfer->speed_hz); else amd_set_spi_freq(amd_spi, spi->max_speed_hz); + /* Reject transfers that would overflow the FIFO window */ + if (fifo_pos + xfer->len > + AMD_SPI_FIFO_BASE + AMD_SPI_FIFO_SIZE) { + message->status = -EMSGSIZE; + goto fin_msg; + } + if (xfer->tx_buf) { buf = (u8 *)xfer->tx_buf; if (!tx_len) { @@ -369,6 +380,12 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi, list_for_each_entry(xfer, &message->transfers, transfer_list) if (xfer->rx_buf) { + /* Reject transfers that would overflow the FIFO window */ + if (fifo_pos + xfer->len > + AMD_SPI_FIFO_BASE + AMD_SPI_FIFO_SIZE) { + message->status = -EMSGSIZE; + goto fin_msg; + } buf = (u8 *)xfer->rx_buf; /* Read data from FIFO to receive buffer */ for (i = 0; i < xfer->len; i++) -- 2.53.0