[+cc Jens, Florian, Stefan, Mark]
On Tue, Jul 19, 2022 at 09:22:35AM +0200, Marc Kleine-Budde wrote:
> In case a IRQ based transfer times out the bcm2835_spi_handle_err()
> function is called. Since commit 1513ceee70f2 ("spi: bcm2835: Drop
> dma_pending flag") the TX and RX DMA transfers are unconditionally
> canceled, leading to NULL pointer derefs if ctlr->dma_tx or
> ctlr->dma_rx are not set.
>
> Fix the NULL pointer deref by checking that ctlr->dma_tx and
> ctlr->dma_rx are valid pointers before accessing them.
>
> Fixes: 1513ceee70f2 ("spi: bcm2835: Drop dma_pending flag")
> Cc: Lukas Wunner <lukas@xxxxxxxxx>
> Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
Link: https://lore.kernel.org/linux-spi/20220603142340.42271-1-jensctl@xxxxxxxxx/
Re: [PATCH] spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
- Subject: Re: [PATCH] spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers
- From: Lukas Wunner <lukas@xxxxxxxxx>
- Date: Tue, 19 Jul 2022 09:47:01 +0200
- Cc: linux-spi@xxxxxxxxxxxxxxx, kernel@xxxxxxxxxxxxxx, Stefan Wahren <stefan.wahren@xxxxxxxx>, Florian Fainelli <f.fainelli@xxxxxxxxx>, Jens Lindahl <jensctl@xxxxxxxxx>
- In-reply-to: <20220719072234.2782764-1-mkl@pengutronix.de>
- References: <20220719072234.2782764-1-mkl@pengutronix.de>
- User-agent: Mutt/1.10.1 (2018-07-13)
- Follow-Ups:
- References:
- [PATCH] spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers
- From: Marc Kleine-Budde
- [PATCH] spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers
- Prev by Date: Re: [PATCH v2 05/10] spi: bcm2835: Drop dma_pending flag
- Next by Date: Re: [PATCH] spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers
- Previous by thread: [PATCH] spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers
- Next by thread: Re: [PATCH] spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers
- Index(es):
 |