summaryrefslogtreecommitdiff
path: root/drivers/spi
diff options
context:
space:
mode:
authorAmit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>2021-04-16 03:46:50 +0300
committerMark Brown <broonie@kernel.org>2021-04-16 15:44:13 +0300
commit2530b3df4326023a171977ab46fdfeac0340f5b2 (patch)
tree0d2d7ac6658c973f96fbe78a43fc34c9fb8016b3 /drivers/spi
parent799f923f0a66a9c99f0a3eaa078b306db7a8b33a (diff)
downloadlinux-2530b3df4326023a171977ab46fdfeac0340f5b2.tar.xz
spi: spi-zynqmp-gqspi: Resolved slab-out-of-bounds bug
During a transfer the driver filled the fifo with 4bytes, even if the data that needs to be transfer is less that 4bytes. This resulted in slab-out-of-bounds bug in KernelAddressSanitizer. This patch resolves slab-out-of-bounds bug by filling the fifo with the number of bytes that needs to transferred. Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com> Link: https://lore.kernel.org/r/20210416004652.2975446-4-quanyang.wang@windriver.com Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'drivers/spi')
-rw-r--r--drivers/spi/spi-zynqmp-gqspi.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
index 1146359528b9..2e2607b5dee9 100644
--- a/drivers/spi/spi-zynqmp-gqspi.c
+++ b/drivers/spi/spi-zynqmp-gqspi.c
@@ -509,17 +509,19 @@ static void zynqmp_qspi_filltxfifo(struct zynqmp_qspi *xqspi, int size)
u32 count = 0, intermediate;
while ((xqspi->bytes_to_transfer > 0) && (count < size) && (xqspi->txbuf)) {
- memcpy(&intermediate, xqspi->txbuf, 4);
- zynqmp_gqspi_write(xqspi, GQSPI_TXD_OFST, intermediate);
-
if (xqspi->bytes_to_transfer >= 4) {
+ memcpy(&intermediate, xqspi->txbuf, 4);
xqspi->txbuf += 4;
xqspi->bytes_to_transfer -= 4;
+ count += 4;
} else {
+ memcpy(&intermediate, xqspi->txbuf,
+ xqspi->bytes_to_transfer);
xqspi->txbuf += xqspi->bytes_to_transfer;
xqspi->bytes_to_transfer = 0;
+ count += xqspi->bytes_to_transfer;
}
- count++;
+ zynqmp_gqspi_write(xqspi, GQSPI_TXD_OFST, intermediate);
}
}