From patchwork Sun Feb 24 12:54:38 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Martin Sperl X-Patchwork-Id: 10827915 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id ADD346C2 for ; Sun, 24 Feb 2019 12:56:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 966DE2AF90 for ; Sun, 24 Feb 2019 12:56:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 88A972B58C; Sun, 24 Feb 2019 12:56:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 3F98D2AF90 for ; Sun, 24 Feb 2019 12:56:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=oY2pauTAnUio3q+PcS2tAKfh+2PWSNSwZPtR0xtok/o=; b=AgG0NofTV2TgmTDeMmGmuDieBs GHk403ufeS3fykvpz8hDwb9cMXQelG9JdyA8roRAUNrQorjYsCyDiBx0xx1hVuQqycsZ4LdlXrpnL MiydCpNwgDYGm5zfMQIiqv+wySotmc61vmmkNf8fNrfkCH/nSPFQvh23vg5R2hAqLoOsDoZtPrD7D rTIgTRrH5uDvMK08wCZKv6e/0R+l1U6aUr/mIww9EkGKkMDWSmxtinEh+QD5yfcrlfRhbTcSUtlKI zGgks0W3ntsM95sJqNl2+hNGDFuJxeFDhsv4Q88MEVzxP0Mk7H1HV9Nwd57GmJaQdcpjfydBTj1pu Fk3SmroQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1gxtKh-000313-8U; Sun, 24 Feb 2019 12:56:39 +0000 Received: from 212-186-180-163.static.upcbusiness.at ([212.186.180.163] helo=cgate.sperl.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1gxtJs-0001f9-6x; Sun, 24 Feb 2019 12:55:51 +0000 Received: from hc1.intern.sperl.org (account martin@sperl.org [10.10.10.59] verified) by sperl.org (CommuniGate Pro SMTP 6.2.1 _community_) with ESMTPSA id 7757563; Sun, 24 Feb 2019 12:55:07 +0000 From: kernel@martin.sperl.org To: Mark Brown , Eric Anholt , Stefan Wahren , Hubert Denkmair , linux-spi@vger.kernel.org, linux-rpi-kernel@lists.infradead.org, linux-arm-kernel@lists.infradead.org Subject: [PATCH 7/9] spi: bcm2835aux: remove dangerous uncontrolled read of fifo Date: Sun, 24 Feb 2019 12:54:38 +0000 Message-Id: <20190224125440.16117-8-kernel@martin.sperl.org> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20190224125440.16117-1-kernel@martin.sperl.org> References: <20190224125440.16117-1-kernel@martin.sperl.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190224_045548_422905_B9C38490 X-CRM114-Status: UNSURE ( 6.45 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Martin Sperl MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP From: Martin Sperl This read of the fifo is a potential candidate for a race condition as the spi transfer is not necessarily finished and so can lead to an early read of the fifo that still misses data. So it has been removed - an additional loop will read the fifo correctly. Fixes: 1ea29b39f4c812ece2f936065a0a3d6fe44a263e (Note: requires Patch 6) Suggested-by: Hubert Denkmair Signed-off-by: Martin Sperl --- drivers/spi/spi-bcm2835aux.c | 7 ------- 1 file changed, 7 deletions(-) -- 2.11.0 diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c index 9552f5343982..8821fc183ca0 100644 --- a/drivers/spi/spi-bcm2835aux.c +++ b/drivers/spi/spi-bcm2835aux.c @@ -246,13 +246,6 @@ static void bcm2835aux_spi_transfer_helper(struct bcm2835aux_spi *bs) BCM2835_AUX_SPI_STAT_TX_FULL))) { bcm2835aux_wr_fifo(bs); } - - /* and check if we have reached "done" */ - while (bs->rx_len && - (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & - BCM2835_AUX_SPI_STAT_BUSY))) { - bcm2835aux_rd_fifo(bs); - } } static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)