Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f9218c2a authored by Joakim Tjernlund's avatar Joakim Tjernlund Committed by Grant Likely
Browse files

spi/spi_mpc8xxx: fix potential memory corruption. 



tx_dma/rx_dma are already set to a dummy buffer when no
tx/rx buffer and t->tx_dma/t->rx_dma does not contain a dma
address, but NULL.
This may lead to corruption of kernel memory. Fix this by
leaving tx_dma/rx_dma alone.

Do not INIT_TX_RX while controller is enabled, this is bad according
to the MPC8321 manual.

Signed-off-by: default avatarJoakim Tjernlund <Joakim.Tjernlund@transmode.se>
Acked-by: default avatarAnton Vorontsov <cbouatmailru@gmail.com>
Signed-off-by: default avatarGrant Likely <grant.likely@secretlab.ca>
parent e40152ee

drivers/spi/spi_mpc8xxx.c

+3 −4
Original line number Diff line number Diff line
@@ -241,7 +241,6 @@ static void mpc8xxx_spi_change_mode(struct spi_device *spi) 


	/* Turn off SPI unit prior changing mode */

	mpc8xxx_spi_write_reg(mode, cs->hw_mode & ~SPMODE_ENABLE);

	mpc8xxx_spi_write_reg(mode, cs->hw_mode);



	/* When in CPM mode, we need to reinit tx and rx. */

	if (mspi->flags & SPI_CPM_MODE) {
@@ -258,7 +257,7 @@ static void mpc8xxx_spi_change_mode(struct spi_device *spi) 
			}

		}

	}



	mpc8xxx_spi_write_reg(mode, cs->hw_mode);

	local_irq_restore(flags);

}
@@ -438,7 +437,7 @@ static int mpc8xxx_spi_cpm_bufs(struct mpc8xxx_spi *mspi, 
			dev_err(dev, "unable to map tx dma\n");

			return -ENOMEM;

		}

	} else {

	} else if (t->tx_buf) {

		mspi->tx_dma = t->tx_dma;

	}
@@ -449,7 +448,7 @@ static int mpc8xxx_spi_cpm_bufs(struct mpc8xxx_spi *mspi, 
			dev_err(dev, "unable to map rx dma\n");

			goto err_rx_dma;

		}

	} else {

	} else if (t->rx_buf) {

		mspi->rx_dma = t->rx_dma;

	}