[patch 2.6.27-rc6] spi_mpc83xx: reject invalid transfer sizes

[patch 2.6.27-rc6] spi_mpc83xx: reject invalid transfer sizes

[David Brownell]

From: Peter Korsgaard <jacmet-OfajU3CKLf1/SzgSGea1oA@public.gmane.org>

Error out on transfer length != multiple of bytes per word.

Signed-off-by: Peter Korsgaard <jacmet-OfajU3CKLf1/SzgSGea1oA@public.gmane.org>
Acked-by: Joakim Tjernlund <Joakim.Tjernlund-SNLAxHN9vbcOP4wsBPIw7w@public.gmane.org>
Signed-off-by: David Brownell <dbrownell-Rn4VEauK+AKRv+LV9MX5uipxlwaOVQ5f@public.gmane.org>
---
 drivers/spi/spi_mpc83xx.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

--- a/drivers/spi/spi_mpc83xx.c
+++ b/drivers/spi/spi_mpc83xx.c
@@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_d
 	if (t->bits_per_word)
 		bits_per_word = t->bits_per_word;
 	len = t->len;
-	if (bits_per_word > 8)
+	if (bits_per_word > 8) {
+		/* invalid length? */
+		if (len & 1)
+			return -EINVAL;
 		len /= 2;
-	if (bits_per_word > 16)
+	}
+	if (bits_per_word > 16) {
+		/* invalid length? */
+		if (len & 1)
+			return -EINVAL;
 		len /= 2;
+	}
 	mpc83xx_spi->count = len;
+
 	INIT_COMPLETION(mpc83xx_spi->done);
 
 	/* enable rx ints */

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/

Re: [patch 2.6.27-rc6] spi_mpc83xx: reject invalid transfer sizes

[Andrew Morton]

On Wed, 10 Sep 2008 17:13:21 -0700 David Brownell <david-b-yBeKhBN/0LDR7s880joybQ@public.gmane.org> wrote:

> From: Peter Korsgaard <jacmet-OfajU3CKLf1/SzgSGea1oA@public.gmane.org>
> 
> Error out on transfer length != multiple of bytes per word.
> 
> Signed-off-by: Peter Korsgaard <jacmet-OfajU3CKLf1/SzgSGea1oA@public.gmane.org>
> Acked-by: Joakim Tjernlund <Joakim.Tjernlund-SNLAxHN9vbcOP4wsBPIw7w@public.gmane.org>
> Signed-off-by: David Brownell <dbrownell-Rn4VEauK+AKRv+LV9MX5uipxlwaOVQ5f@public.gmane.org>
> ---
>  drivers/spi/spi_mpc83xx.c |   13 +++++++++++--
>  1 file changed, 11 insertions(+), 2 deletions(-)
> 
> --- a/drivers/spi/spi_mpc83xx.c
> +++ b/drivers/spi/spi_mpc83xx.c
> @@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_d
>  	if (t->bits_per_word)
>  		bits_per_word = t->bits_per_word;
>  	len = t->len;
> -	if (bits_per_word > 8)
> +	if (bits_per_word > 8) {
> +		/* invalid length? */
> +		if (len & 1)
> +			return -EINVAL;
>  		len /= 2;
> -	if (bits_per_word > 16)
> +	}
> +	if (bits_per_word > 16) {
> +		/* invalid length? */
> +		if (len & 1)
> +			return -EINVAL;
>  		len /= 2;
> +	}
>  	mpc83xx_spi->count = len;
> +
>  	INIT_COMPLETION(mpc83xx_spi->done);
>  
>  	/* enable rx ints */

Why?  What user-visible problem (if any) does this fix?

I have not been provided with sufficient information to be able to
decide whether this fix is needed in 2.6.27.  Please always provide
this.


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/

Re: [patch 2.6.27-rc6] spi_mpc83xx: reject invalid transfer sizes

[Peter Korsgaard]

>>>>> "Andrew" == Andrew Morton <akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org> writes:

 Andrew> Why?  What user-visible problem (if any) does this fix?

I slightly reworded the commit text in the update I sent last night
(no code changes), but David apparently missed it:

[PATCH] spi_mpc83xx: handle odd transfer sizes

Error out on transfer length != multiple of bytes per word with -EINVAL.
Fixes a buffer overrun crash if length < bytes per word.


I hope this is clearer - You can update the text in the patch if you
like.

 Andrew> I have not been provided with sufficient information to be
 Andrew> able to decide whether this fix is needed in 2.6.27.  Please
 Andrew> always provide this.

Sorry, It's 2.6.27 material because of the crash.

-- 
Bye, Peter Korsgaard

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/