From 5c018e378f916b56503bba65cbdec66ad16f20b7 Mon Sep 17 00:00:00 2001 From: Luis de Arquer Date: Fri, 26 Jan 2024 20:46:22 +0100 Subject: [PATCH] spi: spi-rockchip: Fix out of bounds array access Since spi-rockchip enables use_gpio_descriptors and the SPI_CONTROLLER_GPIO_SS flag, the spi subsytem may call set_cs() for spi devices with indexes above ROCKCHIP_SPI_MAX_CS_NUM Remove array cs_asserted[] which held a shadow copy of the state of the chip select lines with the only purpose of optimizing out rewriting a chip select line to the current state (no-op) This case is already handled by spi.c Signed-off-by: Luis de Arquer Link: https://lore.kernel.org/r/d0a0c4b94f933f7f43973c34765214303ee82b77.camel@gmail.com Signed-off-by: Mark Brown --- drivers/spi/spi-rockchip.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c index 4b9669da2cf3..2fb2d65bd5f4 100644 --- a/drivers/spi/spi-rockchip.c +++ b/drivers/spi/spi-rockchip.c @@ -192,8 +192,6 @@ struct rockchip_spi { u8 n_bytes; u8 rsd; - bool cs_asserted[ROCKCHIP_SPI_MAX_CS_NUM]; - bool target_abort; bool cs_inactive; /* spi target tansmition stop when cs inactive */ bool cs_high_supported; /* native CS supports active-high polarity */ @@ -245,10 +243,6 @@ static void rockchip_spi_set_cs(struct spi_device *spi, bool enable) struct rockchip_spi *rs = spi_controller_get_devdata(ctlr); bool cs_asserted = spi->mode & SPI_CS_HIGH ? enable : !enable; - /* Return immediately for no-op */ - if (cs_asserted == rs->cs_asserted[spi_get_chipselect(spi, 0)]) - return; - if (cs_asserted) { /* Keep things powered as long as CS is asserted */ pm_runtime_get_sync(rs->dev); @@ -268,8 +262,6 @@ static void rockchip_spi_set_cs(struct spi_device *spi, bool enable) /* Drop reference from when we first asserted CS */ pm_runtime_put(rs->dev); } - - rs->cs_asserted[spi_get_chipselect(spi, 0)] = cs_asserted; } static void rockchip_spi_handle_err(struct spi_controller *ctlr,