[12/17] spi: dw: Fix dma_slave_config used partly uninitialized

Commit Message

Serge Semin May 8, 2020, 1:29 p.m. UTC

Since the TX and RX DMA-slave config structures are declared on the
stack and only a part of their fields is initialized further in the
prepare Tx/Rx methods, the next dmaengine_slave_config() calls may
randomly perform an incorrect DMA channels setup depending on the
stack initial values. Lets fix this by zeroing the config-structures
before using them.

Co-developed-by: Georgy Vlasov <[e-mail]>
Signed-off-by: Georgy Vlasov <[e-mail]>
Signed-off-by: Serge Semin <[e-mail]>
Cc: Ramil Zaripov <[e-mail]>
Cc: Alexey Malahov <[e-mail]>
Cc: Thomas Bogendoerfer <[e-mail]>
Cc: Paul Burton <[e-mail]>
Cc: Ralf Baechle <[e-mail]>
Cc: Arnd Bergmann <[e-mail]>
Cc: Allison Randal <[e-mail]>
Cc: Andy Shevchenko <[e-mail]>
Cc: Gareth Williams <[e-mail]>
Cc: Rob Herring <[e-mail]>
Cc: [e-mail]
Cc: [e-mail]
---
 drivers/spi/spi-dw-dma.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Andy Shevchenko May 8, 2020, 7:20 p.m. UTC | #1

On Fri, May 08, 2020 at 04:29:37PM +0300, Serge Semin wrote:
> Since the TX and RX DMA-slave config structures are declared on the
> stack and only a part of their fields is initialized further in the
> prepare Tx/Rx methods, the next dmaengine_slave_config() calls may
> randomly perform an incorrect DMA channels setup depending on the
> stack initial values. Lets fix this by zeroing the config-structures
> before using them.

Already in spi/for-next.

Patch

diff --git a/drivers/spi/spi-dw-dma.c b/drivers/spi/spi-dw-dma.c
index d89a00fb705e..3802d2cafe91 100644
--- a/drivers/spi/spi-dw-dma.c
+++ b/drivers/spi/spi-dw-dma.c
@@ -166,7 +166,7 @@  static void dw_spi_dma_tx_done(void *arg)
 static struct dma_async_tx_descriptor *dw_spi_dma_prepare_tx(struct dw_spi *dws,
 		struct spi_transfer *xfer)
 {
-	struct dma_slave_config txconf;
+	struct dma_slave_config txconf = {0};
 	struct dma_async_tx_descriptor *txdesc;
 
 	if (!xfer->tx_buf)
@@ -238,7 +238,7 @@  static void dw_spi_dma_rx_done(void *arg)
 static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws,
 		struct spi_transfer *xfer)
 {
-	struct dma_slave_config rxconf;
+	struct dma_slave_config rxconf = {0};
 	struct dma_async_tx_descriptor *rxdesc;
 
 	if (!xfer->rx_buf)