spi_mpc83xx: reject invalid transfer sizes
PATCH 1/1 spi_mpc83xx: reject invalid transfer sizes
From: Peter Korsgaard <jacmet-OfajU3CKLf1/[email protected]>
Error out on transfer length != multiple of bytes per word.
--- drivers/spi/spi_mpc83xx.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/spi/spi_mpc83xx.c +11 -2
@@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_dif (t->bits_per_word) bits_per_word = t->bits_per_word; len = t->len; -if (bits_per_word >8 ) +if (bits_per_word >8 ) { +/* invalid length? */ +if (len &1 ) +return -EINVAL ; len /=2 ; -if (bits_per_word >16 ) + } +if (bits_per_word >16 ) { +/* invalid length? */ +if (len &1 ) +return -EINVAL ; len /=2 ; + } mpc83xx_spi->count = len; +INIT_COMPLETION (mpc83xx_spi->done);/* enable rx ints */
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
A message that is not in the archive (sent off-list or not yet received): 200809101713.21496.david-b-yBeKhBN/[email protected]
Quoted 26 lines · On Wed, 10 Sep 2008 17:13:21 -0700 David Brownell…
From: Peter Korsgaard <jacmet-OfajU3CKLf1/[email protected]>
Error out on transfer length != multiple of bytes per word.
Signed-off-by Peter Korsgaard <jacmet-OfajU3CKLf1/[email protected]>Acked-by Joakim Tjernlund <[email protected]>Signed-off-by David Brownell <[email protected]>--- drivers/spi/spi_mpc83xx.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)drivers/spi/spi_mpc83xx.c +6
-2@@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_dif (t->bits_per_word) bits_per_word = t->bits_per_word; len = t->len; -if (bits_per_word >8 ) +if (bits_per_word >8 ) { +/* invalid length? */ +if (len &1 ) +return -EINVAL ; len /=2 ; -if (bits_per_word >16 ) + } +if (bits_per_word >16 ) {
drivers/spi/spi_mpc83xx.c static int mpc83xx_spi_bufs(struct spi_d · line 331
Quoted 10 lines
drivers/spi/spi_mpc83xx.c +5
-0+/* invalid length? */ +if (len &1 ) +return -EINVAL ; len /=2 ; + } mpc83xx_spi->count = len; +INIT_COMPLETION (mpc83xx_spi->done);/* enable rx ints */
Why? What user-visible problem (if any) does this fix?
I have not been provided with sufficient information to be able to decide whether this fix is needed in 2.6.27. Please always provide this.
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
A message that is not in the archive (sent off-list or not yet received): 20080910190030.5ef3c1fd.akpm-de/[email protected]
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Andrew" == Andrew Morton <akpm-de/[email protected]> writes:
Andrew> Why? What user-visible problem (if any) does this fix?
I slightly reworded the commit text in the update I sent last night (no code changes), but David apparently missed it:
[PATCH] spi_mpc83xx: handle odd transfer sizes
Error out on transfer length != multiple of bytes per word with -EINVAL. Fixes a buffer overrun crash if length < bytes per word.
I hope this is clearer - You can update the text in the patch if you like.
Andrew> I have not been provided with sufficient information to be Andrew> able to decide whether this fix is needed in 2.6.27. Please Andrew> always provide this.
Sorry, It's 2.6.27 material because of the crash.
Signature · 7 lines
Bye, Peter Korsgaard ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/