If count is less than 4 and memcpy copies less than 4 bytes into var,
some bytes remain uninitialized. These uninitialized bytes are taken
from var and written to the BCM2835_SPI_FIFO register.
While the hardware probably is able to ignore these extra bytes, it's
Undefined Behavior to read uninitialized bytes. So don't do that.
Signed-off-by: Michael Buesch <m@xxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
drivers/spi/spi-bcm2835.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 9c03da7c18dd..5b0119cc2b07 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -253,12 +253,11 @@ static inline void bcm2835_wr_fifo_count(struct bcm2835_spi *bs, int count)
bs->tx_len -= count;
while (count > 0) {
+ val = 0;
if (bs->tx_buf) {
len = min(count, 4);
memcpy(&val, bs->tx_buf, len);
bs->tx_buf += len;
- } else {
- val = 0;
}
bcm2835_wr(bs, BCM2835_SPI_FIFO, val);
count -= 4;
--
2.20.1
Attachment:
pgp4wr9V0UgF6.pgp
Description: OpenPGP digital signature
