Re: [PATCH] spi: sprd-adi: reject transfers shorter than 4 bytes

[Mark Brown]

On Wed, Oct 14, 2026 at 10:00:38PM +0800, Weibin Liu wrote:
> sprd_adi_transfer_one() dereferences t->rx_buf and t->tx_buf as u32
> without validating t->len. The SPI core does not enforce a 4-byte
> minimum, so a transfer of 1..3 bytes (e.g. via spidev) makes the
> driver read 4 bytes through (u32 *)t->rx_buf and store the result
> back, and on the write path read two consecutive u32 values from
> t->tx_buf. With a buffer allocated for fewer bytes this runs off the
> end of it: the read path reads and writes up to 3 bytes past the
> allocation and the write path reads up to 7 bytes past it, corrupting
> adjacent heap objects.

> The ADI protocol only supports 4-byte register accesses, so reject any
> transfer shorter than 4 bytes with -EINVAL before touching the buffers.

Does the same issue not also apply to any transfer that is not a
multiple of 4 bytes?  The driver looks like it will only work for one
very specific device, it only accepts reads or writes that are exactly
four bytes but isn't enforcing that very well.

I also note that sprd_pmic_spi_read() appears to be passing words not
byte lengths and will get broken here if it uses this controller which I
think it does so there's some more substantial changes needed.

Attachment: signature.asc
Description: PGP signature