[PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL

[PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL

[jiada_wang]

From: Jiada Wang <jiada_wang@mentor.com>

In case either transfer->tx_buf or transfer->rx_buf is NULL,
manipulation of buffer in spi_imx_u32_swap_u[8|16]() will cause
NULL pointer dereference crash.

Add buffer check at very beginning of spi_imx_u32_swap_u[8|16](),
to avoid such crash.

Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
---
 drivers/spi/spi-imx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 782045f..19b30cf 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -288,6 +288,9 @@ static void spi_imx_u32_swap_u8(struct spi_transfer *transfer, u32 *buf)
 {
 	int i;
 
+	if (!buf)
+		return;
+
 	for (i = 0; i < transfer->len / 4; i++)
 		*(buf + i) = cpu_to_be32(*(buf + i));
 }
@@ -296,6 +299,9 @@ static void spi_imx_u32_swap_u16(struct spi_transfer *transfer, u32 *buf)
 {
 	int i;
 
+	if (!buf)
+		return;
+
 	for (i = 0; i < transfer->len / 4; i++) {
 		u16 *temp = (u16 *)buf;
 
-- 
2.7.4

Re: [PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL

[Leonard Crestez]

On Thu, 2017-05-18 at 03:01 -0700, jiada_wang@mentor.com wrote:
> From: Jiada Wang <jiada_wang@mentor.com>
> 
> In case either transfer->tx_buf or transfer->rx_buf is NULL,
> manipulation of buffer in spi_imx_u32_swap_u[8|16]() will cause
> NULL pointer dereference crash.
> 
> Add buffer check at very beginning of spi_imx_u32_swap_u[8|16](),
> to avoid such crash.
> 
> Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
> Reported-by: Leonard Crestez <leonard.crestez@nxp.com>

Tested-by: Leonard Crestez <leonard.crestez@nxp.com>

Re: [PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL

[Chris Ruehl]

On Thursday, May 18, 2017 06:01 PM, jiada_wang@mentor.com wrote:
> From: Jiada Wang <jiada_wang@mentor.com>
>
> In case either transfer->tx_buf or transfer->rx_buf is NULL,
> manipulation of buffer in spi_imx_u32_swap_u[8|16]() will cause
> NULL pointer dereference crash.
>
> Add buffer check at very beginning of spi_imx_u32_swap_u[8|16](),
> to avoid such crash.
>
> Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
> Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
> ---
>  drivers/spi/spi-imx.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
> index 782045f..19b30cf 100644
> --- a/drivers/spi/spi-imx.c
> +++ b/drivers/spi/spi-imx.c
> @@ -288,6 +288,9 @@ static void spi_imx_u32_swap_u8(struct spi_transfer *transfer, u32 *buf)
>  {
>  	int i;
>
> +	if (!buf)
> +		return;
> +
>  	for (i = 0; i < transfer->len / 4; i++)
>  		*(buf + i) = cpu_to_be32(*(buf + i));
>  }
> @@ -296,6 +299,9 @@ static void spi_imx_u32_swap_u16(struct spi_transfer *transfer, u32 *buf)
>  {
>  	int i;
>
> +	if (!buf)
> +		return;
> +
>  	for (i = 0; i < transfer->len / 4; i++) {
>  		u16 *temp = (u16 *)buf;
>
>

Hi, thanks for the patch.

But I think we missing something here. We return from a void function()
so the error keeps hidden. The root cause is calling this functions with a NULL 
pointer. See if you can fix this by find the caller and check if the parameter 
hand over are valid.

Cheers
Chris


-- 
GTSYS Limited RFID Technology
9/F, Unit E, R07, Kwai Shing Industrial Building Phase 2,
42-46 Tai Lin Pai Road, Kwai Chung, N.T., Hong Kong
Tel (852) 9079 9521

Disclaimer: http://www.gtsys.com.hk/email/classified.html

Re: [PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL

[Andy Shevchenko]

On Fri, May 19, 2017 at 3:45 PM, Chris Ruehl <chris.ruehl@gtsys.com.hk> wrote:
> On Thursday, May 18, 2017 06:01 PM, jiada_wang@mentor.com wrote:

> But I think we missing something here. We return from a void function()
> so the error keeps hidden. The root cause is calling this functions with a
> NULL pointer. See if you can fix this by find the caller and check if the
> parameter hand over are valid.

AFAIU some SPI controllers can have half-duplex protocol, in which the
second buffer might be absent.


> Disclaimer: http://www.gtsys.com.hk/email/classified.html

Just wondering if it's okay to have this type of footer in open source
community's mailing lists.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 762 bytes --]

On Fri, May 19, 2017 at 04:15:01PM +0300, Andy Shevchenko wrote:
> On Fri, May 19, 2017 at 3:45 PM, Chris Ruehl <chris.ruehl@gtsys.com.hk> wrote:

> > But I think we missing something here. We return from a void function()
> > so the error keeps hidden. The root cause is calling this functions with a
> > NULL pointer. See if you can fix this by find the caller and check if the
> > parameter hand over are valid.

> AFAIU some SPI controllers can have half-duplex protocol, in which the
> second buffer might be absent.

Yes, it's not only perfectly valid but actually the common case for only
one direction of data to be meaningful in SPI so the majority of
controllers don't require data to be transferred in both directions, it
would just add bus overhead.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Applied "spi: imx: fix issue when tx_buf or rx_buf is NULL" to the spi tree

[Mark Brown]

The patch

   spi: imx: fix issue when tx_buf or rx_buf is NULL

has been applied to the spi tree at

   git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git 

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.  

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark

>From 179547e143e773f9f866ad3536275ab627711f3a Mon Sep 17 00:00:00 2001
From: Jiada Wang <jiada_wang@mentor.com>
Date: Thu, 18 May 2017 03:01:12 -0700
Subject: [PATCH] spi: imx: fix issue when tx_buf or rx_buf is NULL

In case either transfer->tx_buf or transfer->rx_buf is NULL,
manipulation of buffer in spi_imx_u32_swap_u[8|16]() will cause
NULL pointer dereference crash.

Add buffer check at very beginning of spi_imx_u32_swap_u[8|16](),
to avoid such crash.

Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
Tested-by: Leonard Crestez <leonard.crestez@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 drivers/spi/spi-imx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 782045f0d79e..19b30cf7d2b7 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -288,6 +288,9 @@ static void spi_imx_u32_swap_u8(struct spi_transfer *transfer, u32 *buf)
 {
 	int i;
 
+	if (!buf)
+		return;
+
 	for (i = 0; i < transfer->len / 4; i++)
 		*(buf + i) = cpu_to_be32(*(buf + i));
 }
@@ -296,6 +299,9 @@ static void spi_imx_u32_swap_u16(struct spi_transfer *transfer, u32 *buf)
 {
 	int i;
 
+	if (!buf)
+		return;
+
 	for (i = 0; i < transfer->len / 4; i++) {
 		u16 *temp = (u16 *)buf;
 
-- 
2.11.0