| Message ID | 1487155852-12102-2-git-send-email-cv-dong@jinso.co.jp (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 02/15/2017 01:50 PM, DongCV wrote: > In qspi_transfer_in(), when receiving the last n (or len) bytes of data, > one bogus byte was written in the receive buffer. > This code leads to a buffer overflow. > > "jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found > at 0x03b40000: 0x1900 instead > jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found > at 0x03b40004: 0x000c instead" > > The error message above happens when trying to mount, unmount, > and remount a jffs2-formatted device. > This patch removed the bogus write to fixes: 3be09bec42a800d4 > "spi: rspi: supports 32bytes buffer for DUAL and QUAD" You were just asked to add the following tag to the patch (e.g. before your signoff): Fixes: 3be09bec42a8 ("spi: rspi: supports 32bytes buffer for DUAL and QUAD") This simplifies the propagation of the patch to the -stable releases... > And here is Geert's comment: > > "spi: rspi: Fix bogus received byte in qspi_transfer_in() > When there are less than QSPI_BUFFER_SIZE remaining bytes to be received, > qspi_transfer_in() writes one bogus byte in the receive buffer, possibly > leading to a buffer overflow. > This can be reproduced by mounting, unmounting, and remounting a > jffs2-formatted device, causing lots of warnings like: > > "jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found > at 0x03b40000: 0x1900 instead" > > Remove the bogus write to fix this. " I don't think effectively duplicating your patch description makes sense here. > Signed-off-by: DongCV <cv-dong@jinso.co.jp> Need full name here. > Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> [...] MBR, Sergei -- To unsubscribe from this list: send the line "unsubscribe linux-spi" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Thank you for your comment!
> And here is Geert's comment: > > "spi: rspi: Fix bogus received byte in qspi_transfer_in() > When there are less than QSPI_BUFFER_SIZE remaining bytes to be received, > qspi_transfer_in() writes one bogus byte in the receive buffer, possibly > leading to a buffer overflow. > This can be reproduced by mounting, unmounting, and remounting a > jffs2-formatted device, causing lots of warnings like: > > "jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found > at 0x03b40000: 0x1900 instead" > > Remove the bogus write to fix this. " Thank you for your comment!
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c index 9daf500..2ee1301 100644 --- a/drivers/spi/spi-rspi.c +++ b/drivers/spi/spi-rspi.c @@ -848,7 +848,6 @@ static int qspi_transfer_in(struct rspi_data *rspi, struct spi_transfer *xfer) ret = rspi_pio_transfer(rspi, NULL, rx, n); if (ret < 0) return ret; - *rx++ = ret; } n -= len; }