CVE-2026-99164: spi: imx: fix slab corruption from undersized DMA bounce buffers

In the Linux kernel, the following vulnerability has been resolved:

spi: imx: fix slab corruption from undersized DMA bounce buffers

Since commit faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode"), the driver allocates its private DMA TX/RX buffers with kzalloc(dmalen), where dmalen is only rounded up to 4 bytes, but maps, syncs and unmaps them with DMACACHEALIGNEDLEN(dmalen), i.e. rounded up to the cache line size. As a result, the DMA API operates on memory beyond the end of the allocation.

This was observed on a custom i.MX8MP platform with an mcp251xfd CAN controller under heavy RPMSG load, as a series of refcountt warnings triggered from rpmsgrecvdone() in virtiorpmsgbus:

refcountt: addition on 0; use-after-free. refcountt: underflow; use-after-free. refcountt: saturated; leaking memory.

Leading finally to an "Unable to handle kernel paging request" oops. Reproducing this problem took between 30 minutes and roughly 30 hours under the same workload.

Hardware watchpoints on the refcount of a struct rpmsgendpoint showed it was overwritten from 2 to 1 by pimemcpygeneric() in the irq/155-spi2.0 thread. Additionally it was found that a "normal" rpmsgrecvdone() took 11µs +/-2µs from its krefget to krefput. In the error case the same sequence took about 215µs +/-10µs. Based on this, an LLM was used to identify the size mismatch fixed here.

Allocate the buffers with DMACACHEALIGNEDLEN(dmalen) so they cover the full mapped length, and use the same length for dmasyncsingleforcpu() to stay consistent with map and unmap.

With this patch applied, the same workload ran for more than 200 hours without the problem reproducing.