From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joakim Tjernlund Subject: [PATCH] spi: spi_mpc8xxx.c: fix potential memory corruption. Date: Wed, 12 May 2010 17:50:50 +0200 Message-ID: <1273679450-4185-1-git-send-email-Joakim.Tjernlund@transmode.se> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: Joakim Tjernlund To: spi-devel-general-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org, avorontsov-hkdhdckH98+B+jHODAdFcQ@public.gmane.org Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: spi-devel-general-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: linux-spi.vger.kernel.org tx_dma/rx_dma are already set to a dummy buffer when no tx/rx buffer and t->tx_dma/t->rx_dma does not contain a dma address, but NULL. This may lead to corruption of kernel memory. Fix this by leaving tx_dma/rx_dma alone. Do not INIT_TX_RX while controller is enabled, this is bad according to the MPC8321 manual. Signed-off-by: Joakim Tjernlund --- drivers/spi/spi_mpc8xxx.c | 7 +++---- 1 files changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/spi/spi_mpc8xxx.c b/drivers/spi/spi_mpc8xxx.c index e1d8045..c312d0e 100644 --- a/drivers/spi/spi_mpc8xxx.c +++ b/drivers/spi/spi_mpc8xxx.c @@ -240,7 +240,6 @@ static void mpc8xxx_spi_change_mode(struct spi_device *spi) /* Turn off SPI unit prior changing mode */ mpc8xxx_spi_write_reg(mode, cs->hw_mode & ~SPMODE_ENABLE); - mpc8xxx_spi_write_reg(mode, cs->hw_mode); /* When in CPM mode, we need to reinit tx and rx. */ if (mspi->flags & SPI_CPM_MODE) { @@ -257,7 +256,7 @@ static void mpc8xxx_spi_change_mode(struct spi_device *spi) } } } - + mpc8xxx_spi_write_reg(mode, cs->hw_mode); local_irq_restore(flags); } @@ -437,7 +436,7 @@ static int mpc8xxx_spi_cpm_bufs(struct mpc8xxx_spi *mspi, dev_err(dev, "unable to map tx dma\n"); return -ENOMEM; } - } else { + } else if (t->tx_buf) { mspi->tx_dma = t->tx_dma; } @@ -448,7 +447,7 @@ static int mpc8xxx_spi_cpm_bufs(struct mpc8xxx_spi *mspi, dev_err(dev, "unable to map rx dma\n"); goto err_rx_dma; } - } else { + } else if (t->rx_buf) { mspi->rx_dma = t->rx_dma; } -- 1.6.4.4 ------------------------------------------------------------------------------