Re: [PATCH 1/6 Revised] SPI omap2_mcspi.c: Check params before dereference or use

[Grant Likely <grant.likely@secretlab.ca>]

On Fri, Mar 12, 2010 at 9:11 AM, Scott Ellis <scott@jumpnowtek.com> wrote:
> This was previously submitted directly to the linux-kernel list.
> It was incomplete the first time because it failed to also check
> the chip_select value.
>
> Check spi->controller_state before dereference.
> Check spi->chip_select for range before use.
>
> Neither are necessarily valid after spi_alloc_device() and
> then spi_add_device() fails. Calling spi_put_device() will
> trigger the error.
>
> Signed-off-by: Scott Ellis <scott@jumpnowtek.com>

Hi Scott,

Can you please respin and repost your pending patches on top of
2.6.34?  The current patches don't apply as-is and I've lost track of
what needs to be done.

Thanks,
g.

>  drivers/spi/omap2_mcspi.c |   30 +++++++++++++++++-------------
>  1 files changed, 17 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/spi/omap2_mcspi.c b/drivers/spi/omap2_mcspi.c
> index 715c518..fe1b56d 100644
> --- a/drivers/spi/omap2_mcspi.c
> +++ b/drivers/spi/omap2_mcspi.c
> @@ -748,22 +748,26 @@ static void omap2_mcspi_cleanup(struct spi_device *spi)
>        struct omap2_mcspi_dma  *mcspi_dma;
>        struct omap2_mcspi_cs   *cs;
>
> -       mcspi = spi_master_get_devdata(spi->master);
> -       mcspi_dma = &mcspi->dma_channels[spi->chip_select];
> +       if (spi->controller_state) {
> +               /* Unlink controller state from context save list */
> +               cs = spi->controller_state;
> +               list_del(&cs->node);
>
> -       /* Unlink controller state from context save list */
> -       cs = spi->controller_state;
> -       list_del(&cs->node);
> +               kfree(spi->controller_state);
> +       }
>
> -       kfree(spi->controller_state);
> +       if (spi->chip_select < spi->master->num_chipselect) {
> +               mcspi = spi_master_get_devdata(spi->master);
> +               mcspi_dma = &mcspi->dma_channels[spi->chip_select];
>
> -       if (mcspi_dma->dma_rx_channel != -1) {
> -               omap_free_dma(mcspi_dma->dma_rx_channel);
> -               mcspi_dma->dma_rx_channel = -1;
> -       }
> -       if (mcspi_dma->dma_tx_channel != -1) {
> -               omap_free_dma(mcspi_dma->dma_tx_channel);
> -               mcspi_dma->dma_tx_channel = -1;
> +               if (mcspi_dma->dma_rx_channel != -1) {
> +                       omap_free_dma(mcspi_dma->dma_rx_channel);
> +                       mcspi_dma->dma_rx_channel = -1;
> +               }
> +               if (mcspi_dma->dma_tx_channel != -1) {
> +                       omap_free_dma(mcspi_dma->dma_tx_channel);
> +                       mcspi_dma->dma_tx_channel = -1;
> +               }
>        }
>  }
>
>
>
>
>
>
>
>
>
>



-- 
Grant Likely, B.Sc., P.Eng.
Secret Lab Technologies Ltd.
--
To unsubscribe from this list: send the line "unsubscribe linux-omap" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html