[PATCH 1/3] spi: spi-rockchip: Fix out of bounds array access

[PATCH 1/3] spi: spi-rockchip: Fix out of bounds array access

[Luis de Arquer]

From: Luis de Arquer <luis.dearquer@inertim.com>

Since spi-rockchip enables use_gpio_descriptors and the
SPI_CONTROLLER_GPIO_SS flag, the spi subsytem may call set_cs()
for spi devices with indexes above ROCKCHIP_SPI_MAX_CS_NUM

Remove array cs_asserted[] which held a shadow copy of the state
of the chip select lines with the only purpose of optimizing out
rewriting a chip select line to the current state (no-op)
This case is already handled by spi.c

Signed-off-by: Luis de Arquer <luis.dearquer@inertim.com>
---
 drivers/spi/spi-rockchip.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
index 4b9669da2cf3..2fb2d65bd5f4 100644
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -192,8 +192,6 @@ struct rockchip_spi {
 	u8 n_bytes;
 	u8 rsd;
 
-	bool cs_asserted[ROCKCHIP_SPI_MAX_CS_NUM];
-
 	bool target_abort;
 	bool cs_inactive; /* spi target tansmition stop when cs inactive */
 	bool cs_high_supported; /* native CS supports active-high polarity */
@@ -245,10 +243,6 @@ static void rockchip_spi_set_cs(struct spi_device *spi, bool enable)
 	struct rockchip_spi *rs = spi_controller_get_devdata(ctlr);
 	bool cs_asserted = spi->mode & SPI_CS_HIGH ? enable : !enable;
 
-	/* Return immediately for no-op */
-	if (cs_asserted == rs->cs_asserted[spi_get_chipselect(spi, 0)])
-		return;
-
 	if (cs_asserted) {
 		/* Keep things powered as long as CS is asserted */
 		pm_runtime_get_sync(rs->dev);
@@ -268,8 +262,6 @@ static void rockchip_spi_set_cs(struct spi_device *spi, bool enable)
 		/* Drop reference from when we first asserted CS */
 		pm_runtime_put(rs->dev);
 	}
-
-	rs->cs_asserted[spi_get_chipselect(spi, 0)] = cs_asserted;
 }
 
 static void rockchip_spi_handle_err(struct spi_controller *ctlr,
-- 
2.34.1

Re: [PATCH 1/3] spi: spi-rockchip: Fix out of bounds array access

[Mark Brown]

On Fri, 26 Jan 2024 20:46:22 +0100, Luis de Arquer wrote:
> Since spi-rockchip enables use_gpio_descriptors and the
> SPI_CONTROLLER_GPIO_SS flag, the spi subsytem may call set_cs()
> for spi devices with indexes above ROCKCHIP_SPI_MAX_CS_NUM
> 
> Remove array cs_asserted[] which held a shadow copy of the state
> of the chip select lines with the only purpose of optimizing out
> rewriting a chip select line to the current state (no-op)
> This case is already handled by spi.c
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-next

Thanks!

[1/3] spi: spi-rockchip: Fix out of bounds array access
      commit: 5c018e378f916b56503bba65cbdec66ad16f20b7

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark