* [PATCH 1/6 Revised] SPI omap2_mcspi.c: Check params before dereference or use
@ 2010-03-12 15:11 Scott Ellis
2010-05-22 9:39 ` Grant Likely
0 siblings, 1 reply; 4+ messages in thread
From: Scott Ellis @ 2010-03-12 15:11 UTC (permalink / raw)
To: spi-devel-general
Cc: David Brownell, Grant Likely, Andrew Morton, Tony Lindgren,
Kevin Hilman, Aaro Koskinen, Roman Tereshonkov, linux-omap
This was previously submitted directly to the linux-kernel list.
It was incomplete the first time because it failed to also check
the chip_select value.
Check spi->controller_state before dereference.
Check spi->chip_select for range before use.
Neither are necessarily valid after spi_alloc_device() and
then spi_add_device() fails. Calling spi_put_device() will
trigger the error.
Signed-off-by: Scott Ellis <scott@jumpnowtek.com>
drivers/spi/omap2_mcspi.c | 30 +++++++++++++++++-------------
1 files changed, 17 insertions(+), 13 deletions(-)
diff --git a/drivers/spi/omap2_mcspi.c b/drivers/spi/omap2_mcspi.c
index 715c518..fe1b56d 100644
--- a/drivers/spi/omap2_mcspi.c
+++ b/drivers/spi/omap2_mcspi.c
@@ -748,22 +748,26 @@ static void omap2_mcspi_cleanup(struct spi_device *spi)
struct omap2_mcspi_dma *mcspi_dma;
struct omap2_mcspi_cs *cs;
- mcspi = spi_master_get_devdata(spi->master);
- mcspi_dma = &mcspi->dma_channels[spi->chip_select];
+ if (spi->controller_state) {
+ /* Unlink controller state from context save list */
+ cs = spi->controller_state;
+ list_del(&cs->node);
- /* Unlink controller state from context save list */
- cs = spi->controller_state;
- list_del(&cs->node);
+ kfree(spi->controller_state);
+ }
- kfree(spi->controller_state);
+ if (spi->chip_select < spi->master->num_chipselect) {
+ mcspi = spi_master_get_devdata(spi->master);
+ mcspi_dma = &mcspi->dma_channels[spi->chip_select];
- if (mcspi_dma->dma_rx_channel != -1) {
- omap_free_dma(mcspi_dma->dma_rx_channel);
- mcspi_dma->dma_rx_channel = -1;
- }
- if (mcspi_dma->dma_tx_channel != -1) {
- omap_free_dma(mcspi_dma->dma_tx_channel);
- mcspi_dma->dma_tx_channel = -1;
+ if (mcspi_dma->dma_rx_channel != -1) {
+ omap_free_dma(mcspi_dma->dma_rx_channel);
+ mcspi_dma->dma_rx_channel = -1;
+ }
+ if (mcspi_dma->dma_tx_channel != -1) {
+ omap_free_dma(mcspi_dma->dma_tx_channel);
+ mcspi_dma->dma_tx_channel = -1;
+ }
}
}
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH 1/6 Revised] SPI omap2_mcspi.c: Check params before dereference or use
2010-03-12 15:11 [PATCH 1/6 Revised] SPI omap2_mcspi.c: Check params before dereference or use Scott Ellis
@ 2010-05-22 9:39 ` Grant Likely
[not found] ` <AANLkTikCydr_Nj446sySru774pY2jXLKNUNVfW3LSK9R-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
0 siblings, 1 reply; 4+ messages in thread
From: Grant Likely @ 2010-05-22 9:39 UTC (permalink / raw)
To: Scott Ellis
Cc: spi-devel-general, David Brownell, Andrew Morton, Tony Lindgren,
Kevin Hilman, Aaro Koskinen, Roman Tereshonkov, linux-omap
On Fri, Mar 12, 2010 at 9:11 AM, Scott Ellis <scott@jumpnowtek.com> wrote:
> This was previously submitted directly to the linux-kernel list.
> It was incomplete the first time because it failed to also check
> the chip_select value.
>
> Check spi->controller_state before dereference.
> Check spi->chip_select for range before use.
>
> Neither are necessarily valid after spi_alloc_device() and
> then spi_add_device() fails. Calling spi_put_device() will
> trigger the error.
>
> Signed-off-by: Scott Ellis <scott@jumpnowtek.com>
Hi Scott,
Can you please respin and repost your pending patches on top of
2.6.34? The current patches don't apply as-is and I've lost track of
what needs to be done.
Thanks,
g.
> drivers/spi/omap2_mcspi.c | 30 +++++++++++++++++-------------
> 1 files changed, 17 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/spi/omap2_mcspi.c b/drivers/spi/omap2_mcspi.c
> index 715c518..fe1b56d 100644
> --- a/drivers/spi/omap2_mcspi.c
> +++ b/drivers/spi/omap2_mcspi.c
> @@ -748,22 +748,26 @@ static void omap2_mcspi_cleanup(struct spi_device *spi)
> struct omap2_mcspi_dma *mcspi_dma;
> struct omap2_mcspi_cs *cs;
>
> - mcspi = spi_master_get_devdata(spi->master);
> - mcspi_dma = &mcspi->dma_channels[spi->chip_select];
> + if (spi->controller_state) {
> + /* Unlink controller state from context save list */
> + cs = spi->controller_state;
> + list_del(&cs->node);
>
> - /* Unlink controller state from context save list */
> - cs = spi->controller_state;
> - list_del(&cs->node);
> + kfree(spi->controller_state);
> + }
>
> - kfree(spi->controller_state);
> + if (spi->chip_select < spi->master->num_chipselect) {
> + mcspi = spi_master_get_devdata(spi->master);
> + mcspi_dma = &mcspi->dma_channels[spi->chip_select];
>
> - if (mcspi_dma->dma_rx_channel != -1) {
> - omap_free_dma(mcspi_dma->dma_rx_channel);
> - mcspi_dma->dma_rx_channel = -1;
> - }
> - if (mcspi_dma->dma_tx_channel != -1) {
> - omap_free_dma(mcspi_dma->dma_tx_channel);
> - mcspi_dma->dma_tx_channel = -1;
> + if (mcspi_dma->dma_rx_channel != -1) {
> + omap_free_dma(mcspi_dma->dma_rx_channel);
> + mcspi_dma->dma_rx_channel = -1;
> + }
> + if (mcspi_dma->dma_tx_channel != -1) {
> + omap_free_dma(mcspi_dma->dma_tx_channel);
> + mcspi_dma->dma_tx_channel = -1;
> + }
> }
> }
>
>
>
>
>
>
>
>
>
>
--
Grant Likely, B.Sc., P.Eng.
Secret Lab Technologies Ltd.
--
To unsubscribe from this list: send the line "unsubscribe linux-omap" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCHv3 1/6] SPI omap2_mcspi.c: Check params before dereference or use
[not found] ` <AANLkTikCydr_Nj446sySru774pY2jXLKNUNVfW3LSK9R-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
@ 2010-05-24 14:20 ` Scott Ellis
2010-05-25 6:28 ` Grant Likely
0 siblings, 1 reply; 4+ messages in thread
From: Scott Ellis @ 2010-05-24 14:20 UTC (permalink / raw)
To: spi-devel-general-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f
Cc: David Brownell, Tony Lindgren, Aaro Koskinen, Kevin Hilman,
Andrew Morton, linux-omap-u79uwXL29TY76Z2rM5mHXA,
Roman Tereshonkov
Check spi->chip_select for range before use.
The spi->controller_state check is already in 2.6.34-rc7
Signed-off-by: Scott Ellis <scott-oZqG5KApg2M/jFmSBShxMA@public.gmane.org>
drivers/spi/omap2_mcspi.c | 19 +++++++++++--------
1 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/drivers/spi/omap2_mcspi.c b/drivers/spi/omap2_mcspi.c
index e0de0d0..0b35468 100644
--- a/drivers/spi/omap2_mcspi.c
+++ b/drivers/spi/omap2_mcspi.c
@@ -755,7 +755,6 @@ static void omap2_mcspi_cleanup(struct spi_device
*spi)
struct omap2_mcspi_cs *cs;
mcspi = spi_master_get_devdata(spi->master);
- mcspi_dma = &mcspi->dma_channels[spi->chip_select];
if (spi->controller_state) {
/* Unlink controller state from context save list */
@@ -765,13 +764,17 @@ static void omap2_mcspi_cleanup(struct spi_device
*spi)
kfree(spi->controller_state);
}
- if (mcspi_dma->dma_rx_channel != -1) {
- omap_free_dma(mcspi_dma->dma_rx_channel);
- mcspi_dma->dma_rx_channel = -1;
- }
- if (mcspi_dma->dma_tx_channel != -1) {
- omap_free_dma(mcspi_dma->dma_tx_channel);
- mcspi_dma->dma_tx_channel = -1;
+ if (spi->chip_select < spi->master->num_chipselect) {
+ mcspi_dma = &mcspi->dma_channels[spi->chip_select];
+
+ if (mcspi_dma->dma_rx_channel != -1) {
+ omap_free_dma(mcspi_dma->dma_rx_channel);
+ mcspi_dma->dma_rx_channel = -1;
+ }
+ if (mcspi_dma->dma_tx_channel != -1) {
+ omap_free_dma(mcspi_dma->dma_tx_channel);
+ mcspi_dma->dma_tx_channel = -1;
+ }
}
}
------------------------------------------------------------------------------
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCHv3 1/6] SPI omap2_mcspi.c: Check params before dereference or use
2010-05-24 14:20 ` [PATCHv3 1/6] " Scott Ellis
@ 2010-05-25 6:28 ` Grant Likely
0 siblings, 0 replies; 4+ messages in thread
From: Grant Likely @ 2010-05-25 6:28 UTC (permalink / raw)
To: Scott Ellis; +Cc: spi-devel-general, linux-omap
On Mon, May 24, 2010 at 8:20 AM, Scott Ellis <scott@jumpnowtek.com> wrote:
> Check spi->chip_select for range before use.
>
> The spi->controller_state check is already in 2.6.34-rc7
>
> Signed-off-by: Scott Ellis <scott@jumpnowtek.com>
Okay, I've pick up this patch, but please check your Evolution
configuration. Patchwork seems to be barfing on the patches sent by
you. My guess is that it relies on a "---" line between the last
"signed-off-by", and the start of the actual patch. See here to see
what I'm talking about:
https://patchwork.kernel.org/patch/101890/
Cheers,
g.
>
> drivers/spi/omap2_mcspi.c | 19 +++++++++++--------
> 1 files changed, 11 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/spi/omap2_mcspi.c b/drivers/spi/omap2_mcspi.c
> index e0de0d0..0b35468 100644
> --- a/drivers/spi/omap2_mcspi.c
> +++ b/drivers/spi/omap2_mcspi.c
> @@ -755,7 +755,6 @@ static void omap2_mcspi_cleanup(struct spi_device
> *spi)
> struct omap2_mcspi_cs *cs;
>
> mcspi = spi_master_get_devdata(spi->master);
> - mcspi_dma = &mcspi->dma_channels[spi->chip_select];
>
> if (spi->controller_state) {
> /* Unlink controller state from context save list */
> @@ -765,13 +764,17 @@ static void omap2_mcspi_cleanup(struct spi_device
> *spi)
> kfree(spi->controller_state);
> }
>
> - if (mcspi_dma->dma_rx_channel != -1) {
> - omap_free_dma(mcspi_dma->dma_rx_channel);
> - mcspi_dma->dma_rx_channel = -1;
> - }
> - if (mcspi_dma->dma_tx_channel != -1) {
> - omap_free_dma(mcspi_dma->dma_tx_channel);
> - mcspi_dma->dma_tx_channel = -1;
> + if (spi->chip_select < spi->master->num_chipselect) {
> + mcspi_dma = &mcspi->dma_channels[spi->chip_select];
> +
> + if (mcspi_dma->dma_rx_channel != -1) {
> + omap_free_dma(mcspi_dma->dma_rx_channel);
> + mcspi_dma->dma_rx_channel = -1;
> + }
> + if (mcspi_dma->dma_tx_channel != -1) {
> + omap_free_dma(mcspi_dma->dma_tx_channel);
> + mcspi_dma->dma_tx_channel = -1;
> + }
> }
> }
>
>
--
Grant Likely, B.Sc., P.Eng.
Secret Lab Technologies Ltd.
--
To unsubscribe from this list: send the line "unsubscribe linux-omap" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2010-05-25 6:28 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-03-12 15:11 [PATCH 1/6 Revised] SPI omap2_mcspi.c: Check params before dereference or use Scott Ellis
2010-05-22 9:39 ` Grant Likely
[not found] ` <AANLkTikCydr_Nj446sySru774pY2jXLKNUNVfW3LSK9R-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2010-05-24 14:20 ` [PATCHv3 1/6] " Scott Ellis
2010-05-25 6:28 ` Grant Likely
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).