linux-spi.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: kernel-TqfNSX0MhmxHKSADF0wUEw@public.gmane.org
To: Mark Brown <broonie-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>,
	Eric Anholt <eric-WhKQ6XTQaPysTnJN9+BGXg@public.gmane.org>,
	Stefan Wahren <stefan.wahren-eS4NqCHxEME@public.gmane.org>,
	Hubert Denkmair
	<h.denkmair-4pT7WzY1KUiELgA04lAiVw@public.gmane.org>,
	linux-spi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-rpi-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org,
	linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org
Subject: [PATCH 7/9] spi: bcm2835aux: remove dangerous uncontrolled read of fifo
Date: Sun, 24 Feb 2019 12:54:38 +0000	[thread overview]
Message-ID: <20190224125440.16117-8-kernel@martin.sperl.org> (raw)
In-Reply-To: <20190224125440.16117-1-kernel-TqfNSX0MhmxHKSADF0wUEw@public.gmane.org>

From: Martin Sperl <kernel-TqfNSX0MhmxHKSADF0wUEw@public.gmane.org>

This read of the fifo is a potential candidate for a race condition
as the spi transfer is not necessarily finished and so can lead to
an early read of the fifo that still misses data.

So it has been removed - an additional loop will read the fifo
correctly.

Fixes: 1ea29b39f4c812ece2f936065a0a3d6fe44a263e
(Note: requires Patch 6)

Suggested-by: Hubert Denkmair <h.denkmair-4pT7WzY1KUiELgA04lAiVw@public.gmane.org>
Signed-off-by: Martin Sperl <kernel-TqfNSX0MhmxHKSADF0wUEw@public.gmane.org>

---
 drivers/spi/spi-bcm2835aux.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 9552f5343982..8821fc183ca0 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -246,13 +246,6 @@ static void bcm2835aux_spi_transfer_helper(struct bcm2835aux_spi *bs)
 		  BCM2835_AUX_SPI_STAT_TX_FULL))) {
 		bcm2835aux_wr_fifo(bs);
 	}
-
-	/* and check if we have reached "done" */
-	while (bs->rx_len &&
-	       (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) &
-		  BCM2835_AUX_SPI_STAT_BUSY))) {
-		bcm2835aux_rd_fifo(bs);
-	}
 }

 static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)
--
2.11.0

  parent reply	other threads:[~2019-02-24 12:54 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-02-24 12:54 [PATCH 0/9] spi: bcm2835aux: bug fixes and improvements kernel-TqfNSX0MhmxHKSADF0wUEw
2019-02-24 12:54 ` [PATCH 1/9] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios kernel
2019-02-24 12:54 ` [PATCH 6/9] spi: bcm2835aux: unifying code between polling and interrupt driven code kernel
     [not found] ` <20190224125440.16117-1-kernel-TqfNSX0MhmxHKSADF0wUEw@public.gmane.org>
2019-02-24 12:54   ` [PATCH 2/9] spi: bcm2835aux: warn in dmesg that native cs is not really supported kernel-TqfNSX0MhmxHKSADF0wUEw
2019-02-24 12:54   ` [PATCH 3/9] spi: bcm2835aux: setup gpio-cs to output and correct level during setup kernel-TqfNSX0MhmxHKSADF0wUEw
2019-02-24 12:54   ` [PATCH 4/9] spi: bcm2835aux: add driver specific stats to debugfs kernel-TqfNSX0MhmxHKSADF0wUEw
2019-02-24 12:54   ` [PATCH 5/9] spi: bcm2835aux: make the polling duration limits configurable kernel-TqfNSX0MhmxHKSADF0wUEw
2019-02-24 12:54   ` kernel-TqfNSX0MhmxHKSADF0wUEw [this message]
2019-02-24 12:54   ` [PATCH 8/9] spi: bcm2835aux: use BCM2835_AUX_SPI_STAT_RX_LVL kernel-TqfNSX0MhmxHKSADF0wUEw
2019-02-24 12:54   ` [PATCH 9/9] spi: bcm2835aux: remove dead code kernel-TqfNSX0MhmxHKSADF0wUEw
2019-02-24 19:22   ` [PATCH 0/9] spi: bcm2835aux: bug fixes and improvements Stefan Wahren
2019-02-24 20:11     ` kernel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190224125440.16117-8-kernel@martin.sperl.org \
    --to=kernel-tqfnsx0mhmxhksadf0wuew@public.gmane.org \
    --cc=broonie-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
    --cc=eric-WhKQ6XTQaPysTnJN9+BGXg@public.gmane.org \
    --cc=h.denkmair-4pT7WzY1KUiELgA04lAiVw@public.gmane.org \
    --cc=linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org \
    --cc=linux-rpi-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org \
    --cc=linux-spi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=stefan.wahren-eS4NqCHxEME@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).