This is a note to let you know that I've just added the patch titled spi: Skip zero-length transfers in spi_transfer_one_message() to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: spi-skip-zero-length-transfers-in-spi_transfer_one_m.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit baf51c8a06461090cf9cf94d820b345b28cc8b7d Author: Nicolas Saenz Julienne <nsaenzjulienne@xxxxxxx> Date: Thu Feb 11 19:08:20 2021 +0100 spi: Skip zero-length transfers in spi_transfer_one_message() [ Upstream commit b306320322c9cfaa465bc2c7367acf6072b1ac0e ] With the introduction of 26751de25d25 ("spi: bcm2835: Micro-optimise FIFO loops") it has become apparent that some users might initiate zero-length SPI transfers. A fact the micro-optimization omitted, and which turned out to cause crashes[1]. Instead of changing the micro-optimization itself, use a bigger hammer and skip zero-length transfers altogether for drivers using the default transfer_one_message() implementation. Reported-by: Phil Elwell <phil@xxxxxxxxxxxxxxx> Fixes: 26751de25d25 ("spi: bcm2835: Micro-optimise FIFO loops") Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@xxxxxxx> [1] https://github.com/raspberrypi/linux/issues/4100 Link: https://lore.kernel.org/r/20210211180820.25757-1-nsaenzjulienne@xxxxxxx Signed-off-by: Mark Brown <broonie@xxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 7694e1ae5b0b2..4257a2d368f71 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -1259,7 +1259,7 @@ static int spi_transfer_one_message(struct spi_controller *ctlr, ptp_read_system_prets(xfer->ptp_sts); } - if (xfer->tx_buf || xfer->rx_buf) { + if ((xfer->tx_buf || xfer->rx_buf) && xfer->len) { reinit_completion(&ctlr->xfer_completion); fallback_pio: