mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 13:22:57 +00:00
spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
[ Upstream commita20ad45008
] The TX buffer in spi_transfer can be a NULL pointer, so the interrupt handler may end up writing to the invalid memory and cause crashes. Add a check to trans->tx_buf before using it. Fixes:1ce24864bf
("spi: mediatek: Only do dma for 4-byte aligned buffers") Signed-off-by: Fei Shao <fshao@chromium.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Link: https://msgid.link/r/20240321070942.1587146-2-fshao@chromium.org Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
e77a6b53a3
commit
1784053cf1
1 changed files with 12 additions and 10 deletions
|
@ -787,6 +787,7 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
|
|||
mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len);
|
||||
mtk_spi_setup_packet(host);
|
||||
|
||||
if (trans->tx_buf) {
|
||||
cnt = mdata->xfer_len / 4;
|
||||
iowrite32_rep(mdata->base + SPI_TX_DATA_REG,
|
||||
trans->tx_buf + mdata->num_xfered, cnt);
|
||||
|
@ -799,6 +800,7 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
|
|||
remainder);
|
||||
writel(reg_val, mdata->base + SPI_TX_DATA_REG);
|
||||
}
|
||||
}
|
||||
|
||||
mtk_spi_enable_transfer(host);
|
||||
|
||||
|
|
Loading…
Reference in a new issue