From patchwork Fri May 19 17:04:54 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 9737761 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 14A52601C2 for ; Fri, 19 May 2017 17:05:23 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F0D692852B for ; Fri, 19 May 2017 17:05:22 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E5BD72852D; Fri, 19 May 2017 17:05:22 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9E2DD2852B for ; Fri, 19 May 2017 17:05:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752905AbdESRFK (ORCPT ); Fri, 19 May 2017 13:05:10 -0400 Received: from mezzanine.sirena.org.uk ([106.187.55.193]:51824 "EHLO mezzanine.sirena.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755844AbdESRFF (ORCPT ); Fri, 19 May 2017 13:05:05 -0400 Received: from [2001:470:1f1d:6b5::3] (helo=debutante) by mezzanine.sirena.org.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1dBlKk-0000WE-OG; Fri, 19 May 2017 17:05:01 +0000 Received: from broonie by debutante with local (Exim 4.89) (envelope-from ) id 1dBlKg-0003rX-TX; Fri, 19 May 2017 18:04:54 +0100 From: Mark Brown To: Jiada Wang Cc: Leonard Crestez , Leonard Crestez , Mark Brown , broonie@kernel.org, linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, leonard.crestez@nxp.com, linux-spi@vger.kernel.org In-Reply-To: <1495101672-3384-1-git-send-email-jiada_wang@mentor.com> Message-Id: Date: Fri, 19 May 2017 18:04:54 +0100 X-SA-Exim-Connect-IP: 2001:470:1f1d:6b5::3 X-SA-Exim-Mail-From: broonie@sirena.org.uk Subject: Applied "spi: imx: fix issue when tx_buf or rx_buf is NULL" to the spi tree X-SA-Exim-Version: 4.2.1 (built Mon, 26 Dec 2011 16:24:06 +0000) X-SA-Exim-Scanned: No (on mezzanine.sirena.org.uk); Unknown failure Sender: linux-spi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-spi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The patch spi: imx: fix issue when tx_buf or rx_buf is NULL has been applied to the spi tree at git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark From 179547e143e773f9f866ad3536275ab627711f3a Mon Sep 17 00:00:00 2001 From: Jiada Wang Date: Thu, 18 May 2017 03:01:12 -0700 Subject: [PATCH] spi: imx: fix issue when tx_buf or rx_buf is NULL In case either transfer->tx_buf or transfer->rx_buf is NULL, manipulation of buffer in spi_imx_u32_swap_u[8|16]() will cause NULL pointer dereference crash. Add buffer check at very beginning of spi_imx_u32_swap_u[8|16](), to avoid such crash. Signed-off-by: Jiada Wang Reported-by: Leonard Crestez Tested-by: Leonard Crestez Signed-off-by: Mark Brown --- drivers/spi/spi-imx.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c index 782045f0d79e..19b30cf7d2b7 100644 --- a/drivers/spi/spi-imx.c +++ b/drivers/spi/spi-imx.c @@ -288,6 +288,9 @@ static void spi_imx_u32_swap_u8(struct spi_transfer *transfer, u32 *buf) { int i; + if (!buf) + return; + for (i = 0; i < transfer->len / 4; i++) *(buf + i) = cpu_to_be32(*(buf + i)); } @@ -296,6 +299,9 @@ static void spi_imx_u32_swap_u16(struct spi_transfer *transfer, u32 *buf) { int i; + if (!buf) + return; + for (i = 0; i < transfer->len / 4; i++) { u16 *temp = (u16 *)buf;