Re: [PATCH] spi: bcm2835: fix NULL pointer deref for OOB transfers.

[Philippe Gerum <rpm@xenomai.org>]

Florian Bezdeka <florian.bezdeka@siemens.com> writes:

> On Wed, 2023-04-12 at 19:09 +0200, Dani Sanz wrote:
>> From: Dani Sanz <sbrk.modules@gmail.com>
>> 
>> There was a problem when calling ioctl(fd, SPI_IOC_ENABLE_OOB_MODE,
>> oob_spi_setup) to use spidev in OOB mode after setting up the spidev.
>> 
>> The kernel crashed because on function
>> bcm2835_spi_start_oob_transfer(struct spi_controller *ctlr, struct
>> spi_oob_transfer *xfer), it tried to access bs->slv->prepare_cs,
>> however bs->slv was NULL.
>> 
>> This patch sets the bs->slv value to the correct bcm2835_spidev object
>> during bcm2835_spi_setup(struct spi_device *spi), so the NULL pointer
>> dereference that happened later is avoided.
>> 
>> Signed-off-by: Dani Sanz <sbrk.modules@gmail.com>
>> ---
>>  drivers/spi/spi-bcm2835.c | 2 ++
>>  1 file changed, 2 insertions(+)
>> 
>> diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
>> index 2626abfc0a5b..1051482df945 100644
>> --- a/drivers/spi/spi-bcm2835.c
>> +++ b/drivers/spi/spi-bcm2835.c
>
> Hi!
>
> Thanks for your patch, but his is the wrong mailing list for this
> issue. The patch should be submitted upstream (Linux) and we will fetch
> it during the next update cycle of Dovetail or IPIPE.
>

Actually, this patch applies specifically to Dovetail, upstream refers
to bs->slv only when TX via DMA is enabled, so there is no issue in this
case. However, Dovetail extends this assumption to any transfer
direction, but fails to init this field accordingly, hence the breakage.

-- 
Philippe.