Re: [patch 2.6.27-rc6] spi_mpc83xx: reject invalid transfer sizes

[Andrew Morton <akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>]

On Wed, 10 Sep 2008 17:13:21 -0700 David Brownell <david-b-yBeKhBN/0LDR7s880joybQ@public.gmane.org> wrote:

> From: Peter Korsgaard <jacmet-OfajU3CKLf1/SzgSGea1oA@public.gmane.org>
> 
> Error out on transfer length != multiple of bytes per word.
> 
> Signed-off-by: Peter Korsgaard <jacmet-OfajU3CKLf1/SzgSGea1oA@public.gmane.org>
> Acked-by: Joakim Tjernlund <Joakim.Tjernlund-SNLAxHN9vbcOP4wsBPIw7w@public.gmane.org>
> Signed-off-by: David Brownell <dbrownell-Rn4VEauK+AKRv+LV9MX5uipxlwaOVQ5f@public.gmane.org>
> ---
>  drivers/spi/spi_mpc83xx.c |   13 +++++++++++--
>  1 file changed, 11 insertions(+), 2 deletions(-)
> 
> --- a/drivers/spi/spi_mpc83xx.c
> +++ b/drivers/spi/spi_mpc83xx.c
> @@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_d
>  	if (t->bits_per_word)
>  		bits_per_word = t->bits_per_word;
>  	len = t->len;
> -	if (bits_per_word > 8)
> +	if (bits_per_word > 8) {
> +		/* invalid length? */
> +		if (len & 1)
> +			return -EINVAL;
>  		len /= 2;
> -	if (bits_per_word > 16)
> +	}
> +	if (bits_per_word > 16) {
> +		/* invalid length? */
> +		if (len & 1)
> +			return -EINVAL;
>  		len /= 2;
> +	}
>  	mpc83xx_spi->count = len;
> +
>  	INIT_COMPLETION(mpc83xx_spi->done);
>  
>  	/* enable rx ints */

Why?  What user-visible problem (if any) does this fix?

I have not been provided with sufficient information to be able to
decide whether this fix is needed in 2.6.27.  Please always provide
this.


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/