From: kernel-TqfNSX0MhmxHKSADF0wUEw@public.gmane.org To: Mark Brown <broonie-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>, Eric Anholt <eric-WhKQ6XTQaPysTnJN9+BGXg@public.gmane.org>, Stefan Wahren <stefan.wahren-eS4NqCHxEME@public.gmane.org>, Hubert Denkmair <h.denkmair-4pT7WzY1KUiELgA04lAiVw@public.gmane.org>, linux-spi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-rpi-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org, linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org Subject: [PATCH V2 2/9] spi: bcm2835aux: remove dangerous uncontrolled read of fifo Date: Sun, 24 Mar 2019 17:49:55 +0000 [thread overview] Message-ID: <20190324175002.28969-3-kernel@martin.sperl.org> (raw) In-Reply-To: <20190324175002.28969-1-kernel-TqfNSX0MhmxHKSADF0wUEw@public.gmane.org> From: Martin Sperl <kernel-TqfNSX0MhmxHKSADF0wUEw@public.gmane.org> This read of the fifo is a potential candidate for a race condition as the spi transfer is not necessarily finished and so can lead to an early read of the fifo that still misses data. So it has been removed. Fixes: 1ea29b39f4c812ece2f936065a0a3d6fe44a263e Suggested-by: Hubert Denkmair <h.denkmair-4pT7WzY1KUiELgA04lAiVw@public.gmane.org> Signed-off-by: Martin Sperl <kernel-TqfNSX0MhmxHKSADF0wUEw@public.gmane.org> --- drivers/spi/spi-bcm2835aux.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c index 41366d0a16af..0838dbda57c7 100644 --- a/drivers/spi/spi-bcm2835aux.c +++ b/drivers/spi/spi-bcm2835aux.c @@ -194,13 +194,6 @@ static void bcm2835aux_spi_transfer_helper(struct bcm2835aux_spi *bs) BCM2835_AUX_SPI_STAT_TX_FULL))) { bcm2835aux_wr_fifo(bs); } - - /* and check if we have reached "done" */ - while (bs->rx_len && - (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & - BCM2835_AUX_SPI_STAT_BUSY))) { - bcm2835aux_rd_fifo(bs); - } } static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) -- 2.11.0
WARNING: multiple messages have this Message-ID (diff)
From: kernel@martin.sperl.org To: Mark Brown <broonie@kernel.org>, Eric Anholt <eric@anholt.net>, Stefan Wahren <stefan.wahren@i2se.com>, Hubert Denkmair <h.denkmair@intence.de>, linux-spi@vger.kernel.org, linux-rpi-kernel@lists.infradead.org, linux-arm-kernel@lists.infradead.org Cc: Martin Sperl <kernel@martin.sperl.org> Subject: [PATCH V2 2/9] spi: bcm2835aux: remove dangerous uncontrolled read of fifo Date: Sun, 24 Mar 2019 17:49:55 +0000 [thread overview] Message-ID: <20190324175002.28969-3-kernel@martin.sperl.org> (raw) In-Reply-To: <20190324175002.28969-1-kernel@martin.sperl.org> From: Martin Sperl <kernel@martin.sperl.org> This read of the fifo is a potential candidate for a race condition as the spi transfer is not necessarily finished and so can lead to an early read of the fifo that still misses data. So it has been removed. Fixes: 1ea29b39f4c812ece2f936065a0a3d6fe44a263e Suggested-by: Hubert Denkmair <h.denkmair@intence.de> Signed-off-by: Martin Sperl <kernel@martin.sperl.org> --- drivers/spi/spi-bcm2835aux.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c index 41366d0a16af..0838dbda57c7 100644 --- a/drivers/spi/spi-bcm2835aux.c +++ b/drivers/spi/spi-bcm2835aux.c @@ -194,13 +194,6 @@ static void bcm2835aux_spi_transfer_helper(struct bcm2835aux_spi *bs) BCM2835_AUX_SPI_STAT_TX_FULL))) { bcm2835aux_wr_fifo(bs); } - - /* and check if we have reached "done" */ - while (bs->rx_len && - (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & - BCM2835_AUX_SPI_STAT_BUSY))) { - bcm2835aux_rd_fifo(bs); - } } static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) -- 2.11.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2019-03-24 17:49 UTC|newest] Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-03-24 17:49 [PATCH V2 0/9] spi: bcm2835aux: bug fixes and improvements kernel 2019-03-24 17:49 ` kernel 2019-03-24 17:49 ` [PATCH V2 3/9] spi: bcm2835aux: use BCM2835_AUX_SPI_STAT_RX_LVL kernel 2019-03-24 17:49 ` kernel 2019-03-25 9:52 ` Stefan Wahren 2019-03-25 9:52 ` Stefan Wahren 2019-03-24 17:49 ` [PATCH V2 6/9] spi: bcm2835aux: warn in dmesg that native cs is not really supported kernel 2019-03-24 17:49 ` kernel 2019-03-25 10:28 ` Stefan Wahren 2019-03-25 10:28 ` Stefan Wahren [not found] ` <20190324175002.28969-1-kernel-TqfNSX0MhmxHKSADF0wUEw@public.gmane.org> 2019-03-24 17:49 ` [PATCH V2 1/9] spi: bcm2835aux: unifying code between polling and interrupt driven code kernel-TqfNSX0MhmxHKSADF0wUEw 2019-03-24 17:49 ` kernel 2019-03-24 17:49 ` kernel-TqfNSX0MhmxHKSADF0wUEw [this message] 2019-03-24 17:49 ` [PATCH V2 2/9] spi: bcm2835aux: remove dangerous uncontrolled read of fifo kernel 2019-03-24 17:49 ` [PATCH V2 4/9] spi: bcm2835aux: remove dead code kernel-TqfNSX0MhmxHKSADF0wUEw 2019-03-24 17:49 ` kernel 2019-03-24 17:49 ` [PATCH V2 5/9] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios kernel-TqfNSX0MhmxHKSADF0wUEw 2019-03-24 17:49 ` kernel 2019-03-24 17:50 ` [PATCH V2 7/9] spi: bcm2835aux: setup gpio-cs to output and correct level during setup kernel-TqfNSX0MhmxHKSADF0wUEw 2019-03-24 17:50 ` kernel 2019-03-24 17:50 ` [PATCH V2 8/9] spi: bcm2835aux: add driver stats to debugfs kernel-TqfNSX0MhmxHKSADF0wUEw 2019-03-24 17:50 ` kernel 2019-03-25 9:28 ` Stefan Wahren 2019-03-25 9:28 ` Stefan Wahren 2019-03-25 9:52 ` kernel 2019-03-25 10:06 ` Stefan Wahren 2019-03-25 10:11 ` kernel 2019-03-25 10:45 ` Stefan Wahren 2019-03-24 17:50 ` [PATCH V2 9/9] spi: bcm2835aux: make the polling duration limits configurable kernel-TqfNSX0MhmxHKSADF0wUEw 2019-03-24 17:50 ` kernel 2019-03-25 9:44 ` Stefan Wahren 2019-03-25 9:44 ` Stefan Wahren 2019-03-25 9:49 ` kernel 2019-03-25 9:49 ` kernel 2019-03-25 9:59 ` Stefan Wahren 2019-03-25 9:59 ` Stefan Wahren
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190324175002.28969-3-kernel@martin.sperl.org \ --to=kernel-tqfnsx0mhmxhksadf0wuew@public.gmane.org \ --cc=broonie-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \ --cc=eric-WhKQ6XTQaPysTnJN9+BGXg@public.gmane.org \ --cc=h.denkmair-4pT7WzY1KUiELgA04lAiVw@public.gmane.org \ --cc=linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org \ --cc=linux-rpi-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org \ --cc=linux-spi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \ --cc=stefan.wahren-eS4NqCHxEME@public.gmane.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.