6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Weibin Liu [ Upstream commit 84182c48999f856c3865e4a537c244f9569c9f6c ] ch341_transfer_one() unconditionally copies from trans->tx_buf into the TX packet and hands trans->rx_buf to usb_bulk_msg() for the readback. The SPI core allows half-duplex transfers where either of the buffers is NULL, so a transfer without TX data crashes the kernel on the memcpy and a transfer without RX data makes usb_bulk_msg() store the received data at address 0. The CH341A clocks data in both directions on every transfer; there is no mode to disable a direction. Set SPI_CONTROLLER_MUST_TX and SPI_CONTROLLER_MUST_RX so the SPI core fills in dummy buffers for half-duplex transfers. Fixes: 8846739f52af ("spi: add ch341a usb2spi driver") Cc: stable@vger.kernel.org # 6.11+ Signed-off-by: Weibin Liu Link: https://patch.msgid.link/20261013054339.77477-1-liuwb@xiaopeng.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin --- drivers/spi/spi-ch341.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/spi/spi-ch341.c b/drivers/spi/spi-ch341.c index 3eaa8f176f63a..170240a0dde89 100644 --- a/drivers/spi/spi-ch341.c +++ b/drivers/spi/spi-ch341.c @@ -189,6 +189,12 @@ static int ch341_probe(struct usb_interface *intf, ctrl->transfer_one = ch341_transfer_one; ctrl->set_cs = ch341_set_cs; ctrl->auto_runtime_pm = false; + /* + * The CH341A SPI_STREAM command clocks data in both directions on + * every transfer, so the driver always needs a TX and an RX buffer; + * let the SPI core supply dummy buffers for half-duplex transfers. + */ + ctrl->flags = SPI_CONTROLLER_MUST_TX | SPI_CONTROLLER_MUST_RX; usb_set_intfdata(intf, ch341); -- 2.53.0