Commit 4b786458 authored by Martin Sperl's avatar Martin Sperl Committed by Mark Brown
Browse files

spi: restore rx/tx_buf in case of unset CONFIG_HAS_DMA 



The case where spi_master sets the flags SPI_MASTER_MUST_RX/TX while
CONFIG_HAS_DMA is unset (which is unlikley) together with a driver
that reuses spi_messages with rx/tx_buff set to NULL, can result in:
* data disclosure over the SPI (for tx_buf == NULL)
* memory corruption (for rx_buf == NULL)

This happenes when dummy_rx/dummy_tx are changing address due to krealloc
or free and an allocation of the memory by a different part of the kernel.

Signed-off-by: default avatarMartin Sperl <kernel@martin.sperl.org>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 8e76ef88

drivers/spi/spi.c

+22 −12
Original line number Diff line number Diff line
@@ -571,7 +571,7 @@ static int __spi_map_msg(struct spi_master *master, struct spi_message *msg) 
	return 0;

}



static int spi_unmap_msg(struct spi_master *master, struct spi_message *msg)

static int __spi_unmap_msg(struct spi_master *master, struct spi_message *msg)

{

	struct spi_transfer *xfer;

	struct device *tx_dev, *rx_dev;
@@ -583,15 +583,6 @@ static int spi_unmap_msg(struct spi_master *master, struct spi_message *msg) 
	rx_dev = master->dma_rx->device->dev;



	list_for_each_entry(xfer, &msg->transfers, transfer_list) {

		/*

		 * Restore the original value of tx_buf or rx_buf if they are

		 * NULL.

		 */

		if (xfer->tx_buf == master->dummy_tx)

			xfer->tx_buf = NULL;

		if (xfer->rx_buf == master->dummy_rx)

			xfer->rx_buf = NULL;



		if (!master->can_dma(master, msg->spi, xfer))

			continue;
@@ -608,13 +599,32 @@ static inline int __spi_map_msg(struct spi_master *master, 
	return 0;

}



static inline int spi_unmap_msg(struct spi_master *master,

static inline int __spi_unmap_msg(struct spi_master *master,

				  struct spi_message *msg)

{

	return 0;

}

#endif /* !CONFIG_HAS_DMA */



static inline int spi_unmap_msg(struct spi_master *master,

				struct spi_message *msg)

{

	struct spi_transfer *xfer;



	list_for_each_entry(xfer, &msg->transfers, transfer_list) {

		/*

		 * Restore the original value of tx_buf or rx_buf if they are

		 * NULL.

		 */

		if (xfer->tx_buf == master->dummy_tx)

			xfer->tx_buf = NULL;

		if (xfer->rx_buf == master->dummy_rx)

			xfer->rx_buf = NULL;

	}



	return __spi_unmap_msg(master, msg);

}



static int spi_map_msg(struct spi_master *master, struct spi_message *msg)

{

	struct spi_transfer *xfer;

CRA Git | Maintained and supported by SUSTech CRA and CCSE