linux-kernel - Fixes: 833026ad56f76d1a1035d6511 ("spi: spidev: prevent spidev->speed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251109233905.8311-1-oss.kiril.maler@gmail.com>
Date: Mon, 10 Nov 2025 00:39:05 +0100
From: Kiril Maler <oss.kiril.maler@...il.com>
To: linux-spi@...r.kernel.org
Cc: linux-kernel@...r.kernel.org,
	broonie@...nel.org,
	Kiril Maler <oss.kiril.maler@...il.com>
Subject: Fixes: 833026ad56f76d1a1035d6511 ("spi: spidev: prevent spidev->speed_hz from being zero")

[PATCH] Revert spi->max_speed_hz only when 0 in ioctl SPI_IOC_WR_MAX_SPEED_HZ

Some drivers (at least drivers/spi/spi-fsl-dspi.c) use spi->max_speed_hz to keep the value
set with last ioctl SPI_IOC_WR_MAX_SPEED_HZ.

But at the end of case SPI_IOC_WR_MAX_SPEED_HZ the value is set back unconditionally to default, highest possible clock.

This results in erratic SPI transfers with highest clock, in my case instead of 6MHz was measured 37,5MHz.

Probably also spidev->speed_hz must be adjusted, because it is used for ioctl SPI_IOC_RD_MAX_SPEED_HZ.

How it was discovered:

My board has SPI Flash and EEPROM chips behind slow FPGA spi-mux logic. Max clock is around 8MHz.

The config sequence in /usr/sbin/flashrom -> linux_spi.c -> linux_spi_init(...) is
	SPI_IOC_WR_MAX_SPEED_HZ
	SPI_IOC_WR_MODE
	SPI_IOC_WR_BITS_PER_WORD

The RDID command to SPI target Flash chips resulted in incorrect Vendor/chipID, or ff ff ff

After adding second SPI_IOC_WR_MAX_SPEED_HZ at the end of config sequence, correct clock
was measured, programming all boards succeeded using flashrom or spi-pipe.

Signed-off-by: Kiril Maler <oss.kiril.maler@...il.com>

index 5300c942a..4ad11381f 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -489,7 +489,7 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 			dev_dbg(&spi->dev, "%d Hz (max)\n", spidev->speed_hz);
 		}

-		spi->max_speed_hz = save;
+		spi->max_speed_hz = spi->max_speed_hz ? : save;
 		break;
 	}
 	default: