* [PATCH] spi: rspi: Fixes bogus received byte and replaces "n" by "len" in commit 3be09be
@ 2017-02-15 9:12 DongCV
2017-02-15 9:20 ` Sergei Shtylyov
0 siblings, 1 reply; 2+ messages in thread
From: DongCV @ 2017-02-15 9:12 UTC (permalink / raw)
To: broonie-DgEjT+Ai2ygdnm+yROfE0A,
geert+renesas-gXvu3+zWzMSzQB+pC5nmwQ,
linux-spi-u79uwXL29TY76Z2rM5mHXA
Cc: kuninori.morimoto.gx-zM6kxYcvzFBBDgjK7y7TUQ,
yoshihiro.shimoda.uh-zM6kxYcvzFBBDgjK7y7TUQ,
ryusuke.sakato.bx-zM6kxYcvzFBBDgjK7y7TUQ,
linux-renesas-soc-u79uwXL29TY76Z2rM5mHXA,
nv-dung-HEF513clHfp3+QwDJ9on6Q,
h-inayoshi-HEF513clHfp3+QwDJ9on6Q,
cm-hiep-HEF513clHfp3+QwDJ9on6Q
In qspi_transfer_in(), when receiving the last n (or len) bytes of data,
1 bogus byte was written in the receive buffer.
This code leads to a buffer overflow.
"jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x03b40000: 0x1900 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x03b40004: 0x000c instead"
The error message above happens when trying to mount, unmount, and remount a jffs2-formatted device.
This patch removed the bogus write and for clearer to use, here replaced "n" by "len" in
qspi_transfer_in() and qspi_transfer_out() to fixes: 3be09bec42a800d4
"spi: rspi: supports 32bytes buffer for DUAL and QUAD"
Here is Geert's comments:
"May I suggest the following:
spi: rspi: Fix bogus received byte in qspi_transfer_in()
When there are less than QSPI_BUFFER_SIZE remaining bytes to be received,
qspi_transfer_in() writes one bogus byte in the receive buffer, possibly
leading to a buffer overflow.
This can be reproduced by mounting, unmounting, and remounting a
jffs2-formatted device, causing lots of warnings like:
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found
at 0x03b40000: 0x1900 instead
Remove the bogus write to fix this.
It's also a good idea to add a Fixes tag:
Fixes: 3be09bec42a800d4 ("spi: rspi: supports 32bytes buffer for
DUAL and QUAD")
(the code was moved afterwards, but both the origin and the move were
integrated in v4.10-rc1)."
Signed-off-by: DongCV <cv-dong-HEF513clHfp3+QwDJ9on6Q@public.gmane.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas-gXvu3+zWzMSzQB+pC5nmwQ@public.gmane.org>
---
drivers/spi/spi-rspi.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 9daf500..bc3c868 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -808,7 +808,7 @@ static int qspi_transfer_out(struct rspi_data *rspi, struct spi_transfer *xfer)
for (i = 0; i < len; i++)
rspi_write_data(rspi, *tx++);
} else {
- ret = rspi_pio_transfer(rspi, tx, NULL, n);
+ ret = rspi_pio_transfer(rspi, tx, NULL, len);
if (ret < 0)
return ret;
}
@@ -845,10 +845,9 @@ static int qspi_transfer_in(struct rspi_data *rspi, struct spi_transfer *xfer)
for (i = 0; i < len; i++)
*rx++ = rspi_read_data(rspi);
} else {
- ret = rspi_pio_transfer(rspi, NULL, rx, n);
+ ret = rspi_pio_transfer(rspi, NULL, rx, len);
if (ret < 0)
return ret;
- *rx++ = ret;
}
n -= len;
}
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-spi" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] spi: rspi: Fixes bogus received byte and replaces "n" by "len" in commit 3be09be
2017-02-15 9:12 [PATCH] spi: rspi: Fixes bogus received byte and replaces "n" by "len" in commit 3be09be DongCV
@ 2017-02-15 9:20 ` Sergei Shtylyov
0 siblings, 0 replies; 2+ messages in thread
From: Sergei Shtylyov @ 2017-02-15 9:20 UTC (permalink / raw)
To: DongCV, broonie, geert+renesas, linux-spi
Cc: kuninori.morimoto.gx, yoshihiro.shimoda.uh, ryusuke.sakato.bx,
linux-renesas-soc, nv-dung, h-inayoshi, cm-hiep
Hello!
On 2/15/2017 12:12 PM, DongCV wrote:
> In qspi_transfer_in(), when receiving the last n (or len) bytes of data,
> 1 bogus byte was written in the receive buffer.
> This code leads to a buffer overflow.
>
> "jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x03b40000: 0x1900 instead
> jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x03b40004: 0x000c instead"
>
> The error message above happens when trying to mount, unmount, and remount a jffs2-formatted device.
> This patch removed the bogus write and for clearer to use, here replaced "n" by "len" in
> qspi_transfer_in() and qspi_transfer_out() to fixes: 3be09bec42a800d4
> "spi: rspi: supports 32bytes buffer for DUAL and QUAD"
I think this is a material for a separate patch.
> Here is Geert's comments:
>
> "May I suggest the following:
>
> spi: rspi: Fix bogus received byte in qspi_transfer_in()
>
> When there are less than QSPI_BUFFER_SIZE remaining bytes to be received,
> qspi_transfer_in() writes one bogus byte in the receive buffer, possibly
> leading to a buffer overflow.
>
> This can be reproduced by mounting, unmounting, and remounting a
> jffs2-formatted device, causing lots of warnings like:
>
> jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found
> at 0x03b40000: 0x1900 instead
>
> Remove the bogus write to fix this.
>
> It's also a good idea to add a Fixes tag:
>
> Fixes: 3be09bec42a800d4 ("spi: rspi: supports 32bytes buffer for
> DUAL and QUAD")
I don't see you adding this tag.
> (the code was moved afterwards, but both the origin and the move were
> integrated in v4.10-rc1)."
>
> Signed-off-by: DongCV <cv-dong@jinso.co.jp>
>
> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
[...]
MBR, Sergei
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-02-15 9:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-15 9:12 [PATCH] spi: rspi: Fixes bogus received byte and replaces "n" by "len" in commit 3be09be DongCV
2017-02-15 9:20 ` Sergei Shtylyov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).