The patch titled spi_mpc83xx: reject invalid transfer sizes has been removed from the -mm tree. Its filename was spi_mpc83xx-reject-invalid-transfer-sizes.patch This patch was dropped because it was merged into mainline or a subsystem tree The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: spi_mpc83xx: reject invalid transfer sizes From: Peter Korsgaard <jacmet@xxxxxxxxxx> Error out on transfer length != multiple of bytes per word with -EINVAL. Fixes a buffer overrun crash if length < bytes per word. Signed-off-by: Peter Korsgaard <jacmet@xxxxxxxxxx> Acked-by: Joakim Tjernlund <Joakim.Tjernlund@xxxxxxxxxxxx> Signed-off-by: David Brownell <dbrownell@xxxxxxxxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/spi/spi_mpc83xx.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff -puN drivers/spi/spi_mpc83xx.c~spi_mpc83xx-reject-invalid-transfer-sizes drivers/spi/spi_mpc83xx.c --- a/drivers/spi/spi_mpc83xx.c~spi_mpc83xx-reject-invalid-transfer-sizes +++ a/drivers/spi/spi_mpc83xx.c @@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_d if (t->bits_per_word) bits_per_word = t->bits_per_word; len = t->len; - if (bits_per_word > 8) + if (bits_per_word > 8) { + /* invalid length? */ + if (len & 1) + return -EINVAL; len /= 2; - if (bits_per_word > 16) + } + if (bits_per_word > 16) { + /* invalid length? */ + if (len & 1) + return -EINVAL; len /= 2; + } mpc83xx_spi->count = len; + INIT_COMPLETION(mpc83xx_spi->done); /* enable rx ints */ _ Patches currently in -mm which might be from jacmet@xxxxxxxxxx are origin.patch linux-next.patch smc911x-remove-duplicate-debug-printout.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html