[PATCH v2 0/2] mfd/spi: sprd: fix ADI transfer length handling

[Weibin Liu]

Thanks for the review.

Both points are right. sprd_pmic_spi_read() passes a word count to
spi_read(), not a byte length, so the v1 check would have broken the
only in-tree user of this controller. The 4-byte minimum was also the
wrong check: the driver only ever performs a 4-byte register read or
an 8-byte register write, so any other length is a caller bug. Short
transfers overrun the buffer, long ones are silently truncated.

v2 splits the fix in two:

- patch 1: sprd_pmic_spi_read() passes sizeof(u32) instead of 1.
  Nothing changes at runtime -- the buffer is 8 bytes on the stack
  and the controller only touches the first u32.

- patch 2: the minimum-length check becomes an exact per-direction
  check: reads must be sizeof(u32), writes 2 * sizeof(u32). This
  also closes the 4..7 byte window v1 left open on the write path.

On severity: this is hardening, not a live security bug. Nothing in
a stock kernel reaches the out-of-bounds access, since spidev is not
normally bound to the ADI controller. Both patches still carry
Cc: stable.

v1: https://lore.kernel.org/r/20261014-spi-sprd-adi-minlen-v1-1-77fee7e64259@xxxxxxxxxxxx

Changes in v2:
- new patch passing a byte length to spi_read()
- exact per-direction length checks instead of the 4-byte minimum

Signed-off-by: Weibin Liu <liuwb@xxxxxxxxxxxx>
---
Weibin Liu (2):
      mfd: sprd-sc27xx: pass byte length to spi_read()
      spi: sprd-adi: enforce the exact transfer length

 drivers/mfd/sprd-sc27xx-spi.c |  2 +-
 drivers/spi/spi-sprd-adi.c    | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)
---
base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
change-id: 20261015-spi-sprd-adi-exactlen-96b130cb61ca

Best regards,
-- 
Weibin Liu <liuwb@xxxxxxxxxxxx>