Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

spi/omap_mcspi: catch xfers of non-multiple SPI word size

If an SPI access was not a multiple of the SPI word size,
the while() loop would spin and the rx/tx ptrs would be incremented
indefinitely.

Signed-off-by: Michael Jones <michael.jones@matrix-vision.de>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>

authored by

Michael Jones and committed by
Grant Likely
adef658d 57d9c10d

+6 -3
+6 -3
drivers/spi/omap2_mcspi.c
··· 487 487 rx_reg = base + OMAP2_MCSPI_RX0; 488 488 chstat_reg = base + OMAP2_MCSPI_CHSTAT0; 489 489 490 + if (c < (word_len>>3)) 491 + return 0; 492 + 490 493 if (word_len <= 8) { 491 494 u8 *rx; 492 495 const u8 *tx; ··· 537 534 dev_vdbg(&spi->dev, "read-%d %02x\n", 538 535 word_len, *(rx - 1)); 539 536 } 540 - } while (c); 537 + } while (c > (word_len>>3)); 541 538 } else if (word_len <= 16) { 542 539 u16 *rx; 543 540 const u16 *tx; ··· 584 581 dev_vdbg(&spi->dev, "read-%d %04x\n", 585 582 word_len, *(rx - 1)); 586 583 } 587 - } while (c); 584 + } while (c > (word_len>>3)); 588 585 } else if (word_len <= 32) { 589 586 u32 *rx; 590 587 const u32 *tx; ··· 631 628 dev_vdbg(&spi->dev, "read-%d %08x\n", 632 629 word_len, *(rx - 1)); 633 630 } 634 - } while (c); 631 + } while (c > (word_len>>3)); 635 632 } 636 633 637 634 /* for TX_ONLY mode, be sure all words have shifted out */