On Sun, Aug 23, 2026 at 2:34 PM <[email protected]> wrote: > [Severity: High] > Will this cause a DMA fault on stack memory? Callers like ssd130x_write_cmd() > allocate the command array on the kernel stack (e.g. u8 buf[8]). Passing > cmd + 1 to ssd130x_write_data() results in a regmap_bulk_write(). On SPI > devices, this passes the buffer directly to the SPI DMA engine. Because > vmalloc-backed kernel stacks forbid DMA, this might cause an immediate > kernel panic or fault during device probe and runtime updates.
This looks like a false positive. regmap_bulk_write() does not pass the caller's buffer to the bus. Since the map has a bus and val_bits is 8, map->format.parse_inplace is non-NULL, so regmap_bulk_write() takes the branch that kmemdup()s the data into a slab-allocated buffer and passes that to regmap_raw_write(). Slab memory is DMA-safe, and the caller's buffer is only ever read via memcpy(). The finding would be valid if the driver called regmap_raw_write() or regmap_noinc_write() directly, since those can hand the pointer straight to bus->gather_write() and into spi_transfer.tx_buf, but it doesn't.
