Re: [PATCH v3] spi: rspi: Fix bogus received byte in qspi_transfer_in()

[Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>]

Hi Dong,

Thanks for the update!

On Wed, Feb 15, 2017 at 8:33 AM, DongCV <cv-dong@xxxxxxxxxxx> wrote:
> In qspi_transfer_in(), when receiving the last n (or len) bytes of data,
> n(or len) bogus bytes were written in the receive buffer,

1 bogus byte was written

And I think you should mention this is a buffer overflow, as this has security
implications (see also "Fixes" below).

> This code leads to the following error that related to jffs2 format
> when trying to mount, unmount, and remount a jffs2-formatted device.
> Remove the bogus write to fix this.

You forgot to mention that you replaced "n" by "len", to improve readability.

> "jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x03b40000: 0x1900 instead
>  jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x03b40004: 0x000c instead"
>
> Signed-off-by: DongCV <cv-dong@xxxxxxxxxxx>

Reviewed-by: Geert Uytterhoeven <geert+renesas@xxxxxxxxx>

Please add

    Fixes: 3be09bec42a800d4 ("spi: rspi: supports 32bytes buffer for
DUAL and QUAD")

so the stable team knows which stable kernel version this needs backporting to.

> ---
>  drivers/spi/spi-rspi.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
> index 9daf500..bc3c868 100644
> --- a/drivers/spi/spi-rspi.c
> +++ b/drivers/spi/spi-rspi.c
> @@ -808,7 +808,7 @@ static int qspi_transfer_out(struct rspi_data *rspi, struct spi_transfer *xfer)
>                         for (i = 0; i < len; i++)
>                                 rspi_write_data(rspi, *tx++);
>                 } else {
> -                       ret = rspi_pio_transfer(rspi, tx, NULL, n);
> +                       ret = rspi_pio_transfer(rspi, tx, NULL, len);
>                         if (ret < 0)
>                                 return ret;
>                 }
> @@ -845,10 +845,9 @@ static int qspi_transfer_in(struct rspi_data *rspi, struct spi_transfer *xfer)
>                         for (i = 0; i < len; i++)
>                                 *rx++ = rspi_read_data(rspi);
>                 } else {
> -                       ret = rspi_pio_transfer(rspi, NULL, rx, n);
> +                       ret = rspi_pio_transfer(rspi, NULL, rx, len);
>                         if (ret < 0)
>                                 return ret;
> -                       *rx++ = ret;
>                 }
>                 n -= len;
>         }

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds
--
To unsubscribe from this list: send the line "unsubscribe linux-spi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html