diff options
| author | Jiada Wang <jiada_wang@mentor.com> | 2017-05-18 12:01:12 +0200 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2017-05-19 18:57:08 +0200 |
| commit | 179547e143e773f9f866ad3536275ab627711f3a (patch) | |
| tree | ef6963146f02d29748b8059a8a7ce31e2abd46b4 /drivers/spi | |
| parent | spi: imx: dynamic burst length adjust for PIO mode (diff) | |
| download | linux-179547e143e773f9f866ad3536275ab627711f3a.tar.xz linux-179547e143e773f9f866ad3536275ab627711f3a.zip | |
spi: imx: fix issue when tx_buf or rx_buf is NULL
In case either transfer->tx_buf or transfer->rx_buf is NULL,
manipulation of buffer in spi_imx_u32_swap_u[8|16]() will cause
NULL pointer dereference crash.
Add buffer check at very beginning of spi_imx_u32_swap_u[8|16](),
to avoid such crash.
Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
Tested-by: Leonard Crestez <leonard.crestez@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'drivers/spi')
| -rw-r--r-- | drivers/spi/spi-imx.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c index 782045f0d79e..19b30cf7d2b7 100644 --- a/drivers/spi/spi-imx.c +++ b/drivers/spi/spi-imx.c @@ -288,6 +288,9 @@ static void spi_imx_u32_swap_u8(struct spi_transfer *transfer, u32 *buf) { int i; + if (!buf) + return; + for (i = 0; i < transfer->len / 4; i++) *(buf + i) = cpu_to_be32(*(buf + i)); } @@ -296,6 +299,9 @@ static void spi_imx_u32_swap_u16(struct spi_transfer *transfer, u32 *buf) { int i; + if (!buf) + return; + for (i = 0; i < transfer->len / 4; i++) { u16 *temp = (u16 *)buf; |