From patchwork Mon May 25 10:13:10 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Martin Sperl X-Patchwork-Id: 6473131 Return-Path: X-Original-To: patchwork-linux-spi@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id C2C70C0020 for ; Mon, 25 May 2015 10:13:28 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id AAD4E203AE for ; Mon, 25 May 2015 10:13:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 61EBA203C0 for ; Mon, 25 May 2015 10:13:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752173AbbEYKNT (ORCPT ); Mon, 25 May 2015 06:13:19 -0400 Received: from 212-186-180-163.dynamic.surfer.at ([212.186.180.163]:50857 "EHLO cgate.sperl.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752140AbbEYKNT (ORCPT ); Mon, 25 May 2015 06:13:19 -0400 Received: from raspb.intern.sperl.org (account martin@sperl.org [10.10.10.32] verified) by sperl.org (CommuniGate Pro SMTP 6.1.2) with ESMTPSA id 6330034; Mon, 25 May 2015 10:13:17 +0000 From: kernel@martin.sperl.org To: Mark Brown , linux-spi@vger.kernel.org Cc: Martin Sperl Subject: [PATCH] spi: restore rx/tx_buf in case of unset CONFIG_HAS_DMA Date: Mon, 25 May 2015 10:13:10 +0000 Message-Id: <1432548790-2249-1-git-send-email-kernel@martin.sperl.org> X-Mailer: git-send-email 1.7.10.4 Sender: linux-spi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-spi@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Martin Sperl The case where spi_master sets the flags SPI_MASTER_MUST_RX/TX while CONFIG_HAS_DMA is unset (which is unlikley) together with a driver that reuses spi_messages with rx/tx_buff set to NULL, can result in: * data disclosure over the SPI (for tx_buf == NULL) * memory corruption (for rx_buf == NULL) This happenes when dummy_rx/dummy_tx are changing address due to krealloc or free and an allocation of the memory by a different part of the kernel. Signed-off-by: Martin Sperl --- drivers/spi/spi.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 647a8bb..01e92f9 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -571,7 +571,7 @@ static int __spi_map_msg(struct spi_master *master, struct spi_message *msg) return 0; } -static int spi_unmap_msg(struct spi_master *master, struct spi_message *msg) +static int __spi_unmap_msg(struct spi_master *master, struct spi_message *msg) { struct spi_transfer *xfer; struct device *tx_dev, *rx_dev; @@ -583,15 +583,6 @@ static int spi_unmap_msg(struct spi_master *master, struct spi_message *msg) rx_dev = master->dma_rx->device->dev; list_for_each_entry(xfer, &msg->transfers, transfer_list) { - /* - * Restore the original value of tx_buf or rx_buf if they are - * NULL. - */ - if (xfer->tx_buf == master->dummy_tx) - xfer->tx_buf = NULL; - if (xfer->rx_buf == master->dummy_rx) - xfer->rx_buf = NULL; - if (!master->can_dma(master, msg->spi, xfer)) continue; @@ -608,13 +599,32 @@ static inline int __spi_map_msg(struct spi_master *master, return 0; } -static inline int spi_unmap_msg(struct spi_master *master, - struct spi_message *msg) +static inline int __spi_unmap_msg(struct spi_master *master, + struct spi_message *msg) { return 0; } #endif /* !CONFIG_HAS_DMA */ +static inline int spi_unmap_msg(struct spi_master *master, + struct spi_message *msg) +{ + struct spi_transfer *xfer; + + list_for_each_entry(xfer, &msg->transfers, transfer_list) { + /* + * Restore the original value of tx_buf or rx_buf if they are + * NULL. + */ + if (xfer->tx_buf == master->dummy_tx) + xfer->tx_buf = NULL; + if (xfer->rx_buf == master->dummy_rx) + xfer->rx_buf = NULL; + } + + return __spi_unmap_msg(master, msg); +} + static int spi_map_msg(struct spi_master *master, struct spi_message *msg) { struct spi_transfer *xfer;