From: quanyang.wang@windriver.com
To: Mark Brown <broonie@kernel.org>,
Michal Simek <michal.simek@xilinx.com>,
Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
Cc: linux-spi@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org,
Quanyang Wang <quanyang.wang@windriver.com>
Subject: [PATCH 3/5] spi: spi-zynqmp-gqspi: Resolved slab-out-of-bounds bug
Date: Fri, 16 Apr 2021 08:46:50 +0800 [thread overview]
Message-ID: <20210416004652.2975446-4-quanyang.wang@windriver.com> (raw)
In-Reply-To: <20210416004652.2975446-1-quanyang.wang@windriver.com>
From: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
During a transfer the driver filled the fifo with 4bytes,
even if the data that needs to be transfer is less that 4bytes.
This resulted in slab-out-of-bounds bug in KernelAddressSanitizer.
This patch resolves slab-out-of-bounds bug by filling the fifo
with the number of bytes that needs to transferred.
Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
---
drivers/spi/spi-zynqmp-gqspi.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
index 1146359528b9..2e2607b5dee9 100644
--- a/drivers/spi/spi-zynqmp-gqspi.c
+++ b/drivers/spi/spi-zynqmp-gqspi.c
@@ -509,17 +509,19 @@ static void zynqmp_qspi_filltxfifo(struct zynqmp_qspi *xqspi, int size)
u32 count = 0, intermediate;
while ((xqspi->bytes_to_transfer > 0) && (count < size) && (xqspi->txbuf)) {
- memcpy(&intermediate, xqspi->txbuf, 4);
- zynqmp_gqspi_write(xqspi, GQSPI_TXD_OFST, intermediate);
-
if (xqspi->bytes_to_transfer >= 4) {
+ memcpy(&intermediate, xqspi->txbuf, 4);
xqspi->txbuf += 4;
xqspi->bytes_to_transfer -= 4;
+ count += 4;
} else {
+ memcpy(&intermediate, xqspi->txbuf,
+ xqspi->bytes_to_transfer);
xqspi->txbuf += xqspi->bytes_to_transfer;
xqspi->bytes_to_transfer = 0;
+ count += xqspi->bytes_to_transfer;
}
- count++;
+ zynqmp_gqspi_write(xqspi, GQSPI_TXD_OFST, intermediate);
}
}
--
2.25.1
next prev parent reply other threads:[~2021-04-16 0:48 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-16 0:46 [PATCH 0/5] spi: spi-zynqmp-gqspi: fix spi issues quanyang.wang
2021-04-16 0:46 ` [PATCH 1/5] spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue quanyang.wang
2021-04-16 12:55 ` Mark Brown
2021-04-16 14:04 ` quanyang.wang
2021-04-16 15:12 ` Mark Brown
2021-04-16 15:37 ` Quanyang Wang
2021-04-16 0:46 ` [PATCH 2/5] spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume quanyang.wang
2021-04-16 0:46 ` quanyang.wang [this message]
2021-04-16 0:46 ` [PATCH 4/5] spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op quanyang.wang
2021-04-16 0:46 ` [PATCH 5/5] spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails quanyang.wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210416004652.2975446-4-quanyang.wang@windriver.com \
--to=quanyang.wang@windriver.com \
--cc=amit.kumar-mahapatra@xilinx.com \
--cc=broonie@kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=michal.simek@xilinx.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).