| Message ID | 20240321070942.1587146-2-fshao@chromium.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | a20ad45008a7c82f1184dc6dee280096009ece55 |
| Headers | show |
| Series | Fixes NULL pointer access in spi-mt65xx.c | expand |
Il 21/03/24 08:08, Fei Shao ha scritto: > The TX buffer in spi_transfer can be a NULL pointer, so the interrupt > handler may end up writing to the invalid memory and cause crashes. > > Add a check to trans->tx_buf before using it. > > Fixes: 1ce24864bff4 ("spi: mediatek: Only do dma for 4-byte aligned buffers") > Signed-off-by: Fei Shao <fshao@chromium.org> Honestly, the code in the !host->can_dma conditional is probably a good candidate for just going into its own function, as it is effectively an alternative flow for the ISR (fifo vs dma xceiv) but whatever, as long as it doesn't get any "longer", it's still fine I guess.... so: Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c index 8d4633b353ee..e4cb22fe0075 100644 --- a/drivers/spi/spi-mt65xx.c +++ b/drivers/spi/spi-mt65xx.c @@ -788,17 +788,19 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id) mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len); mtk_spi_setup_packet(host); - cnt = mdata->xfer_len / 4; - iowrite32_rep(mdata->base + SPI_TX_DATA_REG, - trans->tx_buf + mdata->num_xfered, cnt); + if (trans->tx_buf) { + cnt = mdata->xfer_len / 4; + iowrite32_rep(mdata->base + SPI_TX_DATA_REG, + trans->tx_buf + mdata->num_xfered, cnt); - remainder = mdata->xfer_len % 4; - if (remainder > 0) { - reg_val = 0; - memcpy(®_val, - trans->tx_buf + (cnt * 4) + mdata->num_xfered, - remainder); - writel(reg_val, mdata->base + SPI_TX_DATA_REG); + remainder = mdata->xfer_len % 4; + if (remainder > 0) { + reg_val = 0; + memcpy(®_val, + trans->tx_buf + (cnt * 4) + mdata->num_xfered, + remainder); + writel(reg_val, mdata->base + SPI_TX_DATA_REG); + } } mtk_spi_enable_transfer(host);
The TX buffer in spi_transfer can be a NULL pointer, so the interrupt handler may end up writing to the invalid memory and cause crashes. Add a check to trans->tx_buf before using it. Fixes: 1ce24864bff4 ("spi: mediatek: Only do dma for 4-byte aligned buffers") Signed-off-by: Fei Shao <fshao@chromium.org> --- Changes in v2: - Restore a missing curly brace being dropped during rebase - Fix a typo in commit message (trans, not xfer) drivers/spi/spi-mt65xx.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)