From mboxrd@z Thu Jan 1 00:00:00 1970 From: kernel-TqfNSX0MhmxHKSADF0wUEw@public.gmane.org Subject: [PATCH V3 2/9] spi: bcm2835aux: remove dangerous uncontrolled read of fifo Date: Sat, 30 Mar 2019 09:30:59 +0000 Message-ID: <20190330093106.20723-3-kernel@martin.sperl.org> References: <20190330093106.20723-1-kernel@martin.sperl.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Mark Brown , Eric Anholt , Stefan Wahren , Hubert Denkmair , linux-spi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-rpi-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org, linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org Return-path: In-Reply-To: <20190330093106.20723-1-kernel-TqfNSX0MhmxHKSADF0wUEw@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-rpi-kernel" Errors-To: linux-rpi-kernel-bounces+glkr-linux-rpi-kernel=m.gmane.org-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org List-Id: linux-spi.vger.kernel.org From: Martin Sperl This read of the fifo is a potential candidate for a race condition as the spi transfer is not necessarily finished and so can lead to an early read of the fifo that still misses data. So it has been removed. Fixes: 1ea29b39f4c812ec ("spi: bcm2835aux: add bcm2835 auxiliary spi device...") Suggested-by: Hubert Denkmair Signed-off-by: Martin Sperl --- drivers/spi/spi-bcm2835aux.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c index 41366d0a16af..0838dbda57c7 100644 --- a/drivers/spi/spi-bcm2835aux.c +++ b/drivers/spi/spi-bcm2835aux.c @@ -194,13 +194,6 @@ static void bcm2835aux_spi_transfer_helper(struct bcm2835aux_spi *bs) BCM2835_AUX_SPI_STAT_TX_FULL))) { bcm2835aux_wr_fifo(bs); } - - /* and check if we have reached "done" */ - while (bs->rx_len && - (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & - BCM2835_AUX_SPI_STAT_BUSY))) { - bcm2835aux_rd_fifo(bs); - } } static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) -- 2.11.0 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 597B7C43381 for ; Sat, 30 Mar 2019 09:32:11 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 249FA2075E for ; Sat, 30 Mar 2019 09:32:11 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="U1YWkfj0" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 249FA2075E Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=martin.sperl.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=vO3dv0ylwqP8AKyKJKGO36qiT/NyHt+B4eLC8oV8sbs=; b=U1YWkfj0qOQHbDgc4sR/upCLJL s/YB+6VbmB9ssQhduiveJVMQHuASUZvwx5hTgW/QV+l4wdZ6CwrioQRO8cY7kMIbZ54IqKkboFlpu 2WdXDfmd3+h/tmquuJk3wIuSlmscOBILigny1afi7A7xGqjSM8K/l0zMF2SaLT3EVIEOa/GAsVkHm ecOJGpwjIry27obKdxoUVtM8Uujc9djAROvzCz1AHnoNJA5ULarfa8g1oLzuK3eMC03VeDcsTxtcM XyD27FceNvMPdcyvCpuESI1i0MgfpNB3DvDJiEtkihHXWOUlJ3IdxAs6hIXdcjxc/7sk6ykVweUmj CVoUXaKg==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1hAALK-0001yJ-L9; Sat, 30 Mar 2019 09:32:02 +0000 Received: from 212-186-180-163.static.upcbusiness.at ([212.186.180.163] helo=cgate.sperl.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1hAAKt-0001PE-Ff; Sat, 30 Mar 2019 09:31:39 +0000 Received: from hc1.intern.sperl.org (account martin@sperl.org [10.10.10.59] verified) by sperl.org (CommuniGate Pro SMTP 6.2.1 _community_) with ESMTPSA id 7760019; Sat, 30 Mar 2019 09:31:12 +0000 From: kernel@martin.sperl.org To: Mark Brown , Eric Anholt , Stefan Wahren , Hubert Denkmair , linux-spi@vger.kernel.org, linux-rpi-kernel@lists.infradead.org, linux-arm-kernel@lists.infradead.org Subject: [PATCH V3 2/9] spi: bcm2835aux: remove dangerous uncontrolled read of fifo Date: Sat, 30 Mar 2019 09:30:59 +0000 Message-Id: <20190330093106.20723-3-kernel@martin.sperl.org> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20190330093106.20723-1-kernel@martin.sperl.org> References: <20190330093106.20723-1-kernel@martin.sperl.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190330_023136_164580_D239308A X-CRM114-Status: UNSURE ( 5.93 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Martin Sperl MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: Martin Sperl This read of the fifo is a potential candidate for a race condition as the spi transfer is not necessarily finished and so can lead to an early read of the fifo that still misses data. So it has been removed. Fixes: 1ea29b39f4c812ec ("spi: bcm2835aux: add bcm2835 auxiliary spi device...") Suggested-by: Hubert Denkmair Signed-off-by: Martin Sperl --- drivers/spi/spi-bcm2835aux.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c index 41366d0a16af..0838dbda57c7 100644 --- a/drivers/spi/spi-bcm2835aux.c +++ b/drivers/spi/spi-bcm2835aux.c @@ -194,13 +194,6 @@ static void bcm2835aux_spi_transfer_helper(struct bcm2835aux_spi *bs) BCM2835_AUX_SPI_STAT_TX_FULL))) { bcm2835aux_wr_fifo(bs); } - - /* and check if we have reached "done" */ - while (bs->rx_len && - (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & - BCM2835_AUX_SPI_STAT_BUSY))) { - bcm2835aux_rd_fifo(bs); - } } static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) -- 2.11.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel