iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

spi: restore rx/tx_buf in case of unset CONFIG_HAS_DMA

Browse Source 
The case where spi_master sets the flags SPI_MASTER_MUST_RX/TX while
CONFIG_HAS_DMA is unset (which is unlikley) together with a driver
that reuses spi_messages with rx/tx_buff set to NULL, can result in:
* data disclosure over the SPI (for tx_buf == NULL)
* memory corruption (for rx_buf == NULL)

This happenes when dummy_rx/dummy_tx are changing address due to krealloc
or free and an allocation of the memory by a different part of the kernel.

Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Martin Sperl 2015-05-25 10:13:10 +00:00 committed by Mark Brown
parent 8e76ef88f6
commit 4b786458ed
1 changed files with 22 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
drivers/spi/spi.c
View File

@ -571,7 +571,7 @@ static int __spi_map_msg(struct spi_master *master, struct spi_message *msg)
return 0;
}
static int spi_unmap_msg(struct spi_master *master, struct spi_message *msg)
static int __spi_unmap_msg(struct spi_master *master, struct spi_message *msg)
{
struct spi_transfer *xfer;
struct device *tx_dev, *rx_dev;
@ -583,15 +583,6 @@ static int spi_unmap_msg(struct spi_master *master, struct spi_message *msg)
rx_dev = master->dma_rx->device->dev;
list_for_each_entry(xfer, &msg->transfers, transfer_list) {
/*
* Restore the original value of tx_buf or rx_buf if they are
* NULL.
*/
if (xfer->tx_buf == master->dummy_tx)
xfer->tx_buf = NULL;
if (xfer->rx_buf == master->dummy_rx)
xfer->rx_buf = NULL;
if (!master->can_dma(master, msg->spi, xfer))
continue;
@ -608,13 +599,32 @@ static inline int __spi_map_msg(struct spi_master *master,
return 0;
}
static inline int spi_unmap_msg(struct spi_master *master,
struct spi_message *msg)
static inline int __spi_unmap_msg(struct spi_master *master,
struct spi_message *msg)
{
return 0;
}
#endif /* !CONFIG_HAS_DMA */
static inline int spi_unmap_msg(struct spi_master *master,
struct spi_message *msg)
{
struct spi_transfer *xfer;
list_for_each_entry(xfer, &msg->transfers, transfer_list) {
/*
* Restore the original value of tx_buf or rx_buf if they are
* NULL.
*/
if (xfer->tx_buf == master->dummy_tx)
xfer->tx_buf = NULL;
if (xfer->rx_buf == master->dummy_rx)
xfer->rx_buf = NULL;
}
return __spi_unmap_msg(master, msg);
}
static int spi_map_msg(struct spi_master *master, struct spi_message *msg)
{
struct spi_transfer *xfer;