* [PATCH AUTOSEL 4.9 01/20] spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf'
@ 2021-07-04 23:11 Sasha Levin
2021-07-04 23:11 ` [PATCH AUTOSEL 4.9 02/20] spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages() Sasha Levin
2021-07-04 23:11 ` [PATCH AUTOSEL 4.9 03/20] spi: omap-100k: Fix the length judgment problem Sasha Levin
0 siblings, 2 replies; 3+ messages in thread
From: Sasha Levin @ 2021-07-04 23:11 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jay Fang, Mark Brown, Sasha Levin, linux-spi
From: Jay Fang <f.fangjian@huawei.com>
[ Upstream commit 9e37a3ab0627011fb63875e9a93094b6fc8ddf48 ]
In function 'spi_test_run_iter': Value 'tx_buf' might be 'rx_buf'.
Signed-off-by: Jay Fang <f.fangjian@huawei.com>
Link: https://lore.kernel.org/r/1620629903-15493-5-git-send-email-f.fangjian@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-loopback-test.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
index 7120083fe761..cac38753d0cd 100644
--- a/drivers/spi/spi-loopback-test.c
+++ b/drivers/spi/spi-loopback-test.c
@@ -803,7 +803,7 @@ static int spi_test_run_iter(struct spi_device *spi,
test.transfers[i].len = len;
if (test.transfers[i].tx_buf)
test.transfers[i].tx_buf += tx_off;
- if (test.transfers[i].tx_buf)
+ if (test.transfers[i].rx_buf)
test.transfers[i].rx_buf += rx_off;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH AUTOSEL 4.9 02/20] spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages()
2021-07-04 23:11 [PATCH AUTOSEL 4.9 01/20] spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf' Sasha Levin
@ 2021-07-04 23:11 ` Sasha Levin
2021-07-04 23:11 ` [PATCH AUTOSEL 4.9 03/20] spi: omap-100k: Fix the length judgment problem Sasha Levin
1 sibling, 0 replies; 3+ messages in thread
From: Sasha Levin @ 2021-07-04 23:11 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jay Fang, Mark Brown, Sasha Levin, linux-spi
From: Jay Fang <f.fangjian@huawei.com>
[ Upstream commit 026a1dc1af52742c5897e64a3431445371a71871 ]
pch_spi_set_tx() frees data->pkt_tx_buff on failure of kzalloc() for
data->pkt_rx_buff, but its caller, pch_spi_process_messages(), will
free data->pkt_tx_buff again. Set data->pkt_tx_buff to NULL after
kfree() to avoid double free.
Signed-off-by: Jay Fang <f.fangjian@huawei.com>
Link: https://lore.kernel.org/r/1620284888-65215-1-git-send-email-f.fangjian@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-topcliff-pch.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index fe707440f8c3..9b24ebbba346 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -585,8 +585,10 @@ static void pch_spi_set_tx(struct pch_spi_data *data, int *bpw)
data->pkt_tx_buff = kzalloc(size, GFP_KERNEL);
if (data->pkt_tx_buff != NULL) {
data->pkt_rx_buff = kzalloc(size, GFP_KERNEL);
- if (!data->pkt_rx_buff)
+ if (!data->pkt_rx_buff) {
kfree(data->pkt_tx_buff);
+ data->pkt_tx_buff = NULL;
+ }
}
if (!data->pkt_rx_buff) {
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH AUTOSEL 4.9 03/20] spi: omap-100k: Fix the length judgment problem
2021-07-04 23:11 [PATCH AUTOSEL 4.9 01/20] spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf' Sasha Levin
2021-07-04 23:11 ` [PATCH AUTOSEL 4.9 02/20] spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages() Sasha Levin
@ 2021-07-04 23:11 ` Sasha Levin
1 sibling, 0 replies; 3+ messages in thread
From: Sasha Levin @ 2021-07-04 23:11 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tian Tao, Mark Brown, Sasha Levin, linux-spi
From: Tian Tao <tiantao6@hisilicon.com>
[ Upstream commit e7a1a3abea373e41ba7dfe0fbc93cb79b6a3a529 ]
word_len should be checked in the omap1_spi100k_setup_transfer
function to see if it exceeds 32.
Signed-off-by: Tian Tao <tiantao6@hisilicon.com>
Link: https://lore.kernel.org/r/1619695248-39045-1-git-send-email-tiantao6@hisilicon.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-omap-100k.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c
index 1eccdc4a4581..2eeb0fe2eed2 100644
--- a/drivers/spi/spi-omap-100k.c
+++ b/drivers/spi/spi-omap-100k.c
@@ -251,7 +251,7 @@ static int omap1_spi100k_setup_transfer(struct spi_device *spi,
else
word_len = spi->bits_per_word;
- if (spi->bits_per_word > 32)
+ if (word_len > 32)
return -EINVAL;
cs->word_len = word_len;
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-07-04 23:15 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-04 23:11 [PATCH AUTOSEL 4.9 01/20] spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf' Sasha Levin
2021-07-04 23:11 ` [PATCH AUTOSEL 4.9 02/20] spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages() Sasha Levin
2021-07-04 23:11 ` [PATCH AUTOSEL 4.9 03/20] spi: omap-100k: Fix the length judgment problem Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).