[1/2] spi: rspi: Fixes bogus received byte in qspi_transfer_in()

Commit Message

Cao Van Dong Feb. 15, 2017, 10:50 a.m. UTC

In qspi_transfer_in(), when receiving the last n (or len) bytes of data,
one bogus byte was written in the receive buffer.
This code leads to a buffer overflow.

"jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found 
at 0x03b40000: 0x1900 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found 
at 0x03b40004: 0x000c instead"

The error message above happens when trying to mount, unmount,
and remount a jffs2-formatted device.
This patch removed the bogus write to fixes: 3be09bec42a800d4
"spi: rspi: supports 32bytes buffer for DUAL and QUAD"

And here is Geert's comment:

"spi: rspi: Fix bogus received byte in qspi_transfer_in()
When there are less than QSPI_BUFFER_SIZE remaining bytes to be received,
qspi_transfer_in() writes one bogus byte in the receive buffer, possibly
leading to a buffer overflow.
This can be reproduced by mounting, unmounting, and remounting a
jffs2-formatted device, causing lots of warnings like:

"jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found
at 0x03b40000: 0x1900 instead"

Remove the bogus write to fix this. "

Signed-off-by: DongCV <[e-mail]>
Reviewed-by: Geert Uytterhoeven <[e-mail]>
---
 drivers/spi/spi-rspi.c | 1 -
 1 file changed, 1 deletion(-)

Comments

Sergei Shtylyov Feb. 15, 2017, 12:17 p.m. UTC | #1

On 02/15/2017 01:50 PM, DongCV wrote:

> In qspi_transfer_in(), when receiving the last n (or len) bytes of data,
> one bogus byte was written in the receive buffer.
> This code leads to a buffer overflow.
>
> "jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found
> at 0x03b40000: 0x1900 instead
> jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found
> at 0x03b40004: 0x000c instead"
>
> The error message above happens when trying to mount, unmount,
> and remount a jffs2-formatted device.
> This patch removed the bogus write to fixes: 3be09bec42a800d4
> "spi: rspi: supports 32bytes buffer for DUAL and QUAD"

    You were just asked to add the following tag to the patch (e.g. before 
your signoff):

Fixes: 3be09bec42a8 ("spi: rspi: supports 32bytes buffer for DUAL and QUAD")

This simplifies the propagation of the patch to the -stable releases...

> And here is Geert's comment:
>
> "spi: rspi: Fix bogus received byte in qspi_transfer_in()
> When there are less than QSPI_BUFFER_SIZE remaining bytes to be received,
> qspi_transfer_in() writes one bogus byte in the receive buffer, possibly
> leading to a buffer overflow.
> This can be reproduced by mounting, unmounting, and remounting a
> jffs2-formatted device, causing lots of warnings like:
>
> "jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found
> at 0x03b40000: 0x1900 instead"
>
> Remove the bogus write to fix this. "

    I don't think effectively duplicating your patch description makes sense here.

> Signed-off-by: DongCV <[e-mail]>

    Need full name here.

> Reviewed-by: Geert Uytterhoeven <[e-mail]>
[...]

MBR, Sergei

Patch

diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 9daf500..2ee1301 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -848,7 +848,6 @@  static int qspi_transfer_in(struct rspi_data *rspi, struct spi_transfer *xfer)
 			ret = rspi_pio_transfer(rspi, NULL, rx, n);
 			if (ret < 0)
 				return ret;
-			*rx++ = ret;
 		}
 		n -= len;
 	}