linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Hubert Denkmair <h.denkmair@intence.de>,
	Martin Sperl <kernel@martin.sperl.org>,
	Stefan Wahren <stefan.wahren@i2se.com>,
	Mark Brown <broonie@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.4 19/23] spi: bcm2835aux: remove dangerous uncontrolled read of fifo
Date: Sun,  8 Sep 2019 13:41:54 +0100	[thread overview]
Message-ID: <20190908121102.838776856@linuxfoundation.org> (raw)
In-Reply-To: <20190908121052.898169328@linuxfoundation.org>

[ Upstream commit c7de8500fd8ecbb544846dd5f11dca578c3777e1 ]

This read of the fifo is a potential candidate for a race condition
as the spi transfer is not necessarily finished and so can lead to
an early read of the fifo that still misses data.

So it has been removed.

Fixes: 1ea29b39f4c812ec ("spi: bcm2835aux: add bcm2835 auxiliary spi device...")
Suggested-by: Hubert Denkmair <h.denkmair@intence.de>
Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm2835aux.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 5b2c2b2e13396..4d233356772aa 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -197,13 +197,6 @@ static void bcm2835aux_spi_transfer_helper(struct bcm2835aux_spi *bs)
 		  BCM2835_AUX_SPI_STAT_TX_FULL))) {
 		bcm2835aux_wr_fifo(bs);
 	}
-
-	/* and check if we have reached "done" */
-	while (bs->rx_len &&
-	       (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) &
-		  BCM2835_AUX_SPI_STAT_BUSY))) {
-		bcm2835aux_rd_fifo(bs);
-	}
 }
 
 static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)
-- 
2.20.1




  parent reply	other threads:[~2019-09-08 12:43 UTC|newest]

Thread overview: 29+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-08 12:41 [PATCH 4.4 00/23] 4.4.192-stable review Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 01/23] net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 02/23] net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 03/23] Bluetooth: btqca: Add a short delay before downloading the NVM Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 04/23] ibmveth: Convert multicast list size for little-endian system Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 05/23] gpio: Fix build error of function redefinition Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 06/23] cxgb4: fix a memory leak bug Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 07/23] net: myri10ge: fix memory leaks Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 08/23] cx82310_eth: fix a memory leak bug Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 09/23] net: kalmia: fix memory leaks Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 10/23] wimax/i2400m: fix a memory leak bug Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 11/23] ravb: Fix use-after-free ravb_tstamp_skb Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 12/23] Tools: hv: kvp: eliminate may be used uninitialized warning Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 13/23] IB/mlx4: Fix memory leaks Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 14/23] ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr() Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 15/23] KVM: arm/arm64: Only skip MMIO insn once Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 16/23] libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 17/23] spi: bcm2835aux: ensure interrupts are enabled for shared handler Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 18/23] spi: bcm2835aux: unifying code between polling and interrupt driven code Greg Kroah-Hartman
2019-09-08 12:41 ` Greg Kroah-Hartman [this message]
2019-09-08 12:41 ` [PATCH 4.4 20/23] spi: bcm2835aux: fix corruptions for longer spi transfers Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 21/23] Revert "x86/apic: Include the LDR when clearing out APIC registers" Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 22/23] net: fix skb use after free in netpoll Greg Kroah-Hartman
2019-09-08 12:41 ` [PATCH 4.4 23/23] net: stmmac: dwmac-rk: Dont fail if phy regulator is absent Greg Kroah-Hartman
2019-09-08 16:38 ` [PATCH 4.4 00/23] 4.4.192-stable review kernelci.org bot
2019-09-09 13:19 ` Naresh Kamboju
2019-09-09 14:49 ` Bharath Vedartham
2019-09-09 19:38 ` Guenter Roeck
2019-09-10  9:18 ` Jon Hunter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190908121102.838776856@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=broonie@kernel.org \
    --cc=h.denkmair@intence.de \
    --cc=kernel@martin.sperl.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=stefan.wahren@i2se.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).