mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-01 06:33:07 +00:00
Code Issues Releases Wiki Activity

spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op

Browse source 
When handling op->addr, it is using the buffer "tmpbuf" which has been
freed. This will trigger a use-after-free KASAN warning. Let's use
temporary variables to store op->addr.val and op->cmd.opcode to fix
this issue.

Fixes: 1c26372e5a ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
Link: https://lore.kernel.org/r/20210416004652.2975446-5-quanyang.wang@windriver.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Quanyang Wang 2021-04-16 08:46:51 +08:00 committed by Mark Brown
parent 2530b3df43
commit a2c5bedb2d
No known key found for this signature in database
GPG key ID: 24D68B725D5487D0
1 changed files with 4 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
drivers/spi/spi-zynqmp-gqspi.c
View file

@ -928,8 +928,9 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
struct zynqmp_qspi *xqspi = spi_controller_get_devdata
(mem->spi->master);
int err = 0, i;
u8 *tmpbuf;
u32 genfifoentry = 0;
u16 opcode = op->cmd.opcode;
u64 opaddr;
dev_dbg(xqspi->dev, "cmd:%#x mode:%d.%d.%d.%d\n",
op->cmd.opcode, op->cmd.buswidth, op->addr.buswidth,
@ -942,14 +943,8 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
genfifoentry |= xqspi->genfifobus;
if (op->cmd.opcode) {
tmpbuf = kzalloc(op->cmd.nbytes, GFP_KERNEL | GFP_DMA);
if (!tmpbuf) {
mutex_unlock(&xqspi->op_lock);
return -ENOMEM;
}
tmpbuf[0] = op->cmd.opcode;
reinit_completion(&xqspi->data_completion);
xqspi->txbuf = tmpbuf;
xqspi->txbuf = &opcode;
xqspi->rxbuf = NULL;
xqspi->bytes_to_transfer = op->cmd.nbytes;
xqspi->bytes_to_receive = 0;
@ -963,13 +958,12 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
if (!wait_for_completion_timeout
(&xqspi->data_completion, msecs_to_jiffies(1000))) {
err = -ETIMEDOUT;
kfree(tmpbuf);
goto return_err;
}
kfree(tmpbuf);
}
if (op->addr.nbytes) {
xqspi->txbuf = &opaddr;
for (i = 0; i < op->addr.nbytes; i++) {
*(((u8 *)xqspi->txbuf) + i) = op->addr.val >>
(8 * (op->addr.nbytes - i - 1));