[PATCH] spi: spi-imx: Add check for spi_imx_setupxfer()

[PATCH] spi: spi-imx: Add check for spi_imx_setupxfer()

[Tamura Dai]

Add check for the return value of spi_imx_setupxfer().
spi_imx->rx and spi_imx->tx function pointer can be NULL when
spi_imx_setupxfer() return error, and make NULL pointer dereference.

 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
 Call trace:
  0x0
  spi_imx_pio_transfer+0x50/0xd8
  spi_imx_transfer_one+0x18c/0x858
  spi_transfer_one_message+0x43c/0x790
  __spi_pump_transfer_message+0x238/0x5d4
  __spi_sync+0x2b0/0x454
  spi_write_then_read+0x11c/0x200

Signed-off-by: Tamura Dai <kirinode0@gmail.com>
---
 drivers/spi/spi-imx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 832d6e9009eb..c93d80a4d734 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -1695,9 +1695,12 @@ static int spi_imx_transfer_one(struct spi_controller *controller,
 				struct spi_device *spi,
 				struct spi_transfer *transfer)
 {
+	int ret;
 	struct spi_imx_data *spi_imx = spi_controller_get_devdata(spi->controller);
 
-	spi_imx_setupxfer(spi, transfer);
+	ret = spi_imx_setupxfer(spi, transfer);
+	if (ret < 0)
+		return ret;
 	transfer->effective_speed_hz = spi_imx->spi_bus_clk;
 
 	/* flush rxfifo before transfer */
-- 
2.47.2

RE: [EXT] [PATCH] spi: spi-imx: Add check for spi_imx_setupxfer()

[Carlos Song]

Hi, Thank you for fix.

Reviewed-by: Carlos Song <carlos.song@nxp.com>

> -----Original Message-----
> From: Tamura Dai <kirinode0@gmail.com>
> Sent: Thursday, April 17, 2025 9:16 AM
> To: Mark Brown <broonie@kernel.org>; Shawn Guo <shawnguo@kernel.org>;
> Sascha Hauer <s.hauer@pengutronix.de>; Pengutronix Kernel Team
> <kernel@pengutronix.de>; Fabio Estevam <festevam@gmail.com>
> Cc: linux-spi@vger.kernel.org; imx@lists.linux.dev;
> linux-arm-kernel@lists.infradead.org; linux-kernel@vger.kernel.org; Tamura Dai
> <kirinode0@gmail.com>
> Subject: [EXT] [PATCH] spi: spi-imx: Add check for spi_imx_setupxfer()
> 
> [You don't often get email from kirinode0@gmail.com. Learn why this is
> important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> Caution: This is an external email. Please take care when clicking links or
> opening attachments. When in doubt, report the message using the 'Report
> this email' button
> 
> 
> Add check for the return value of spi_imx_setupxfer().
> spi_imx->rx and spi_imx->tx function pointer can be NULL when
> spi_imx_setupxfer() return error, and make NULL pointer dereference.
> 
>  Unable to handle kernel NULL pointer dereference at virtual address
> 0000000000000000  Call trace:
>   0x0
>   spi_imx_pio_transfer+0x50/0xd8
>   spi_imx_transfer_one+0x18c/0x858
>   spi_transfer_one_message+0x43c/0x790
>   __spi_pump_transfer_message+0x238/0x5d4
>   __spi_sync+0x2b0/0x454
>   spi_write_then_read+0x11c/0x200
> 
> Signed-off-by: Tamura Dai <kirinode0@gmail.com>
> ---
>  drivers/spi/spi-imx.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c index
> 832d6e9009eb..c93d80a4d734 100644
> --- a/drivers/spi/spi-imx.c
> +++ b/drivers/spi/spi-imx.c
> @@ -1695,9 +1695,12 @@ static int spi_imx_transfer_one(struct
> spi_controller *controller,
>                                 struct spi_device *spi,
>                                 struct spi_transfer *transfer)  {
> +       int ret;
>         struct spi_imx_data *spi_imx =
> spi_controller_get_devdata(spi->controller);
> 
> -       spi_imx_setupxfer(spi, transfer);
> +       ret = spi_imx_setupxfer(spi, transfer);
> +       if (ret < 0)
> +               return ret;
>         transfer->effective_speed_hz = spi_imx->spi_bus_clk;
> 
>         /* flush rxfifo before transfer */
> --
> 2.47.2
> 

Re: [PATCH] spi: spi-imx: Add check for spi_imx_setupxfer()

[Mark Brown]

On Thu, 17 Apr 2025 10:16:05 +0900, Tamura Dai wrote:
> Add check for the return value of spi_imx_setupxfer().
> spi_imx->rx and spi_imx->tx function pointer can be NULL when
> spi_imx_setupxfer() return error, and make NULL pointer dereference.
> 
>  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
>  Call trace:
>   0x0
>   spi_imx_pio_transfer+0x50/0xd8
>   spi_imx_transfer_one+0x18c/0x858
>   spi_transfer_one_message+0x43c/0x790
>   __spi_pump_transfer_message+0x238/0x5d4
>   __spi_sync+0x2b0/0x454
>   spi_write_then_read+0x11c/0x200
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-next

Thanks!

[1/1] spi: spi-imx: Add check for spi_imx_setupxfer()
      commit: 951a04ab3a2db4029debfa48d380ef834b93207e

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark