diff options
| author | Joakim Tjernlund <Joakim.Tjernlund@transmode.se> | 2010-05-22 10:18:02 +0200 |
|---|---|---|
| committer | Grant Likely <grant.likely@secretlab.ca> | 2010-05-22 10:18:02 +0200 |
| commit | f9218c2a60facc6ff9a793a9d9ab956194d70012 (patch) | |
| tree | 03876aab569a848ee44b741fd389856738470148 /drivers/spi | |
| parent | Linus 2.6.34 (diff) | |
| download | linux-f9218c2a60facc6ff9a793a9d9ab956194d70012.tar.xz linux-f9218c2a60facc6ff9a793a9d9ab956194d70012.zip | |
spi/spi_mpc8xxx: fix potential memory corruption.
tx_dma/rx_dma are already set to a dummy buffer when no
tx/rx buffer and t->tx_dma/t->rx_dma does not contain a dma
address, but NULL.
This may lead to corruption of kernel memory. Fix this by
leaving tx_dma/rx_dma alone.
Do not INIT_TX_RX while controller is enabled, this is bad according
to the MPC8321 manual.
Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Acked-by: Anton Vorontsov <cbouatmailru@gmail.com>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Diffstat (limited to 'drivers/spi')
| -rw-r--r-- | drivers/spi/spi_mpc8xxx.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/drivers/spi/spi_mpc8xxx.c b/drivers/spi/spi_mpc8xxx.c index 14d052316502..0dfc482bbff5 100644 --- a/drivers/spi/spi_mpc8xxx.c +++ b/drivers/spi/spi_mpc8xxx.c @@ -241,7 +241,6 @@ static void mpc8xxx_spi_change_mode(struct spi_device *spi) /* Turn off SPI unit prior changing mode */ mpc8xxx_spi_write_reg(mode, cs->hw_mode & ~SPMODE_ENABLE); - mpc8xxx_spi_write_reg(mode, cs->hw_mode); /* When in CPM mode, we need to reinit tx and rx. */ if (mspi->flags & SPI_CPM_MODE) { @@ -258,7 +257,7 @@ static void mpc8xxx_spi_change_mode(struct spi_device *spi) } } } - + mpc8xxx_spi_write_reg(mode, cs->hw_mode); local_irq_restore(flags); } @@ -438,7 +437,7 @@ static int mpc8xxx_spi_cpm_bufs(struct mpc8xxx_spi *mspi, dev_err(dev, "unable to map tx dma\n"); return -ENOMEM; } - } else { + } else if (t->tx_buf) { mspi->tx_dma = t->tx_dma; } @@ -449,7 +448,7 @@ static int mpc8xxx_spi_cpm_bufs(struct mpc8xxx_spi *mspi, dev_err(dev, "unable to map rx dma\n"); goto err_rx_dma; } - } else { + } else if (t->rx_buf) { mspi->rx_dma = t->rx_dma; } |