From patchwork Sat Jul 9 21:14:58 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vasily Khoruzhick X-Patchwork-Id: 960212 Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) by demeter1.kernel.org (8.14.4/8.14.4) with ESMTP id p69LGigo009412 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 9 Jul 2011 21:17:05 GMT Received: from canuck.infradead.org ([2001:4978:20e::1]) by merlin.infradead.org with esmtps (Exim 4.76 #1 (Red Hat Linux)) id 1Qfet3-0005QG-79; Sat, 09 Jul 2011 21:16:29 +0000 Received: from localhost ([127.0.0.1] helo=canuck.infradead.org) by canuck.infradead.org with esmtp (Exim 4.76 #1 (Red Hat Linux)) id 1Qfet2-0006L9-R0; Sat, 09 Jul 2011 21:16:28 +0000 Received: from mail-bw0-f49.google.com ([209.85.214.49]) by canuck.infradead.org with esmtps (Exim 4.76 #1 (Red Hat Linux)) id 1Qfesz-0006Kp-8F for linux-arm-kernel@lists.infradead.org; Sat, 09 Jul 2011 21:16:26 +0000 Received: by bwf12 with SMTP id 12so2992863bwf.36 for ; Sat, 09 Jul 2011 14:16:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer; bh=rKQ7349jtCfYFqYMded4CVMKiJnpEB+iTh7WiD64ZM0=; b=YCOpxKWUmgeA3LiyvwqYs+0Ktn53dibbzUyNUYtmg2AQAtvrYD28CbbJ2k4HdbPZgv htEdcF/IerCfZUNy3MoydvECW4vdf2QeIPbAyM9DiB4xh62hQ2NgIgT2t6HAf4e3Mr+4 8MUR/k8TPNx2briUT5xrAQKkOdSbmkzvWi7kY= Received: by 10.205.65.206 with SMTP id xn14mr981952bkb.329.1310246175218; Sat, 09 Jul 2011 14:16:15 -0700 (PDT) Received: from localhost.localdomain ([212.98.182.62]) by mx.google.com with ESMTPS id e16sm603460bke.39.2011.07.09.14.16.12 (version=TLSv1/SSLv3 cipher=OTHER); Sat, 09 Jul 2011 14:16:13 -0700 (PDT) From: Vasily Khoruzhick To: linux-arm-kernel@lists.infradead.org, Eric Miao , spi-devel-general@lists.sourceforge.net Subject: [PATCH] pxa2xx_spi: fix memory corruption Date: Sun, 10 Jul 2011 00:14:58 +0300 Message-Id: <1310246098-21208-1-git-send-email-anarsoul@gmail.com> X-Mailer: git-send-email 1.7.5.rc3 X-CRM114-Version: 20090807-BlameThorstenAndJenny ( TRE 0.7.6 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20110709_171625_583898_89CF04C8 X-CRM114-Status: GOOD ( 14.09 ) X-Spam-Score: -0.8 (/) X-Spam-Report: SpamAssassin version 3.3.1 on canuck.infradead.org summary: Content analysis details: (-0.8 points) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (anarsoul[at]gmail.com) -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.214.49 listed in list.dnswl.org] Cc: Vasily Khoruzhick X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: linux-arm-kernel-bounces@lists.infradead.org Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Sat, 09 Jul 2011 21:17:14 +0000 (UTC) pxa2xx_spi_probe allocates struct driver_data and null_dma_buf at same time via spi_alloc_master(), but then calculates null_dma_buf pointer incorrectly, and it causes memory corruption later if DMA usage is enabled. Signed-off-by: Vasily Khoruzhick --- drivers/spi/pxa2xx_spi.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c index dc25bee..ef38fbf 100644 --- a/drivers/spi/pxa2xx_spi.c +++ b/drivers/spi/pxa2xx_spi.c @@ -1569,7 +1569,7 @@ static int __devinit pxa2xx_spi_probe(struct platform_device *pdev) master->transfer = transfer; drv_data->ssp_type = ssp->type; - drv_data->null_dma_buf = (u32 *)ALIGN((u32)(drv_data + + drv_data->null_dma_buf = (u32 *)ALIGN(((u32)drv_data + sizeof(struct driver_data)), 8); drv_data->ioaddr = ssp->mmio_base;