Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1644035 > unrolled thread

[PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL

Back to article view | Back to linux.kernel

Contents

  [PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL <jiada_wang@mentor.com> - 2017-05-18 12:10 +0200
    Re: [PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL Chris Ruehl <chris.ruehl@gtsys.com.hk> - 2017-05-19 15:00 +0200
      Re: [PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-05-19 15:20 +0200
        Re: [PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL Mark Brown <broonie@kernel.org> - 2017-05-19 19:00 +0200
    Applied "spi: imx: fix issue when tx_buf or rx_buf is NULL" to the spi tree Mark Brown <broonie@kernel.org> - 2017-05-19 19:10 +0200

#1644035 — [PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL

From: Jiada Wang <jiada_wang@mentor.com>

In case either transfer->tx_buf or transfer->rx_buf is NULL,
manipulation of buffer in spi_imx_u32_swap_u[8|16]() will cause
NULL pointer dereference crash.

Add buffer check at very beginning of spi_imx_u32_swap_u[8|16](),
to avoid such crash.

Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
---
 drivers/spi/spi-imx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 782045f..19b30cf 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -288,6 +288,9 @@ static void spi_imx_u32_swap_u8(struct spi_transfer *transfer, u32 *buf)
 {
 	int i;
 
+	if (!buf)
+		return;
+
 	for (i = 0; i < transfer->len / 4; i++)
 		*(buf + i) = cpu_to_be32(*(buf + i));
 }
@@ -296,6 +299,9 @@ static void spi_imx_u32_swap_u16(struct spi_transfer *transfer, u32 *buf)
 {
 	int i;
 
+	if (!buf)
+		return;
+
 	for (i = 0; i < transfer->len / 4; i++) {
 		u16 *temp = (u16 *)buf;
 
-- 
2.7.4

[toc] | [next] | [standalone]

#1645585

On Thursday, May 18, 2017 06:01 PM, jiada_wang@mentor.com wrote:
> From: Jiada Wang <jiada_wang@mentor.com>
>
> In case either transfer->tx_buf or transfer->rx_buf is NULL,
> manipulation of buffer in spi_imx_u32_swap_u[8|16]() will cause
> NULL pointer dereference crash.
>
> Add buffer check at very beginning of spi_imx_u32_swap_u[8|16](),
> to avoid such crash.
>
> Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
> Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
> ---
>  drivers/spi/spi-imx.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
> index 782045f..19b30cf 100644
> --- a/drivers/spi/spi-imx.c
> +++ b/drivers/spi/spi-imx.c
> @@ -288,6 +288,9 @@ static void spi_imx_u32_swap_u8(struct spi_transfer *transfer, u32 *buf)
>  {
>  	int i;
>
> +	if (!buf)
> +		return;
> +
>  	for (i = 0; i < transfer->len / 4; i++)
>  		*(buf + i) = cpu_to_be32(*(buf + i));
>  }
> @@ -296,6 +299,9 @@ static void spi_imx_u32_swap_u16(struct spi_transfer *transfer, u32 *buf)
>  {
>  	int i;
>
> +	if (!buf)
> +		return;
> +
>  	for (i = 0; i < transfer->len / 4; i++) {
>  		u16 *temp = (u16 *)buf;
>
>

Hi, thanks for the patch.

But I think we missing something here. We return from a void function()
so the error keeps hidden. The root cause is calling this functions with a NULL 
pointer. See if you can fix this by find the caller and check if the parameter 
hand over are valid.

Cheers
Chris


-- 
GTSYS Limited RFID Technology
9/F, Unit E, R07, Kwai Shing Industrial Building Phase 2,
42-46 Tai Lin Pai Road, Kwai Chung, N.T., Hong Kong
Tel (852) 9079 9521

Disclaimer: http://www.gtsys.com.hk/email/classified.html

[toc] | [prev] | [next] | [standalone]

#1645596

On Fri, May 19, 2017 at 3:45 PM, Chris Ruehl <chris.ruehl@gtsys.com.hk> wrote:
> On Thursday, May 18, 2017 06:01 PM, jiada_wang@mentor.com wrote:

> But I think we missing something here. We return from a void function()
> so the error keeps hidden. The root cause is calling this functions with a
> NULL pointer. See if you can fix this by find the caller and check if the
> parameter hand over are valid.

AFAIU some SPI controllers can have half-duplex protocol, in which the
second buffer might be absent.


> Disclaimer: http://www.gtsys.com.hk/email/classified.html

Just wondering if it's okay to have this type of footer in open source
community's mailing lists.

-- 
With Best Regards,
Andy Shevchenko

[toc] | [prev] | [next] | [standalone]

#1645766

[Multipart message — attachments visible in raw view] — view raw

On Fri, May 19, 2017 at 04:15:01PM +0300, Andy Shevchenko wrote:
> On Fri, May 19, 2017 at 3:45 PM, Chris Ruehl <chris.ruehl@gtsys.com.hk> wrote:

> > But I think we missing something here. We return from a void function()
> > so the error keeps hidden. The root cause is calling this functions with a
> > NULL pointer. See if you can fix this by find the caller and check if the
> > parameter hand over are valid.

> AFAIU some SPI controllers can have half-duplex protocol, in which the
> second buffer might be absent.

Yes, it's not only perfectly valid but actually the common case for only
one direction of data to be meaningful in SPI so the majority of
controllers don't require data to be transferred in both directions, it
would just add bus overhead.

[toc] | [prev] | [next] | [standalone]

#1645771 — Applied "spi: imx: fix issue when tx_buf or rx_buf is NULL" to the spi tree

The patch

   spi: imx: fix issue when tx_buf or rx_buf is NULL

has been applied to the spi tree at

   git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git 

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.  

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark

From 179547e143e773f9f866ad3536275ab627711f3a Mon Sep 17 00:00:00 2001
From: Jiada Wang <jiada_wang@mentor.com>
Date: Thu, 18 May 2017 03:01:12 -0700
Subject: [PATCH] spi: imx: fix issue when tx_buf or rx_buf is NULL

In case either transfer->tx_buf or transfer->rx_buf is NULL,
manipulation of buffer in spi_imx_u32_swap_u[8|16]() will cause
NULL pointer dereference crash.

Add buffer check at very beginning of spi_imx_u32_swap_u[8|16](),
to avoid such crash.

Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
Tested-by: Leonard Crestez <leonard.crestez@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
 drivers/spi/spi-imx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 782045f0d79e..19b30cf7d2b7 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -288,6 +288,9 @@ static void spi_imx_u32_swap_u8(struct spi_transfer *transfer, u32 *buf)
 {
 	int i;
 
+	if (!buf)
+		return;
+
 	for (i = 0; i < transfer->len / 4; i++)
 		*(buf + i) = cpu_to_be32(*(buf + i));
 }
@@ -296,6 +299,9 @@ static void spi_imx_u32_swap_u16(struct spi_transfer *transfer, u32 *buf)
 {
 	int i;
 
+	if (!buf)
+		return;
+
 	for (i = 0; i < transfer->len / 4; i++) {
 		u16 *temp = (u16 *)buf;
 
-- 
2.11.0

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web