Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 34093cb9 authored by Ricardo Ribalda Delgado's avatar Ricardo Ribalda Delgado Committed by Mark Brown
Browse files

spi/xilinx: Fix access invalid memory on xilinx_spi_tx 



On 1 and 2 bytes per word, the transfer of the 3 last bytes will access
memory outside tx_ptr.

Although this has not trigger any error on real hardware, we should
better fix this.

Fixes: 24ba5e59 (Remove rx_fn and tx_fn pointer)
Signed-off-by: default avatarRicardo Ribalda Delgado <ricardo.ribalda@gmail.com>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 0635287a

drivers/spi/spi-xilinx.c

+16 −1
Original line number Original line Diff line number Diff line
@@ -117,11 +117,26 @@ static unsigned int xspi_read32_be(void __iomem *addr) 




static void xilinx_spi_tx(struct xilinx_spi *xspi)

static void xilinx_spi_tx(struct xilinx_spi *xspi)

{

{

	u32 data = 0;



	if (!xspi->tx_ptr) {

	if (!xspi->tx_ptr) {

		xspi->write_fn(0, xspi->regs + XSPI_TXD_OFFSET);

		xspi->write_fn(0, xspi->regs + XSPI_TXD_OFFSET);

		return;

		return;

	}

	}

	xspi->write_fn(*(u32 *)(xspi->tx_ptr), xspi->regs + XSPI_TXD_OFFSET);



	switch (xspi->bytes_per_word) {

	case 1:

		data = *(u8 *)(xspi->tx_ptr);

		break;

	case 2:

		data = *(u16 *)(xspi->tx_ptr);

		break;

	case 4:

		data = *(u32 *)(xspi->tx_ptr);

		break;

	}



	xspi->write_fn(data, xspi->regs + XSPI_TXD_OFFSET);

	xspi->tx_ptr += xspi->bytes_per_word;

	xspi->tx_ptr += xspi->bytes_per_word;

}

}