diff options
| author | Amit Kumar Mahapatra | 2021-04-16 08:46:50 +0800 |
|---|---|---|
| committer | Mark Brown | 2021-04-16 13:44:13 +0100 |
| commit | 2530b3df4326023a171977ab46fdfeac0340f5b2 (patch) | |
| tree | 0d2d7ac6658c973f96fbe78a43fc34c9fb8016b3 | |
| parent | 799f923f0a66a9c99f0a3eaa078b306db7a8b33a (diff) | |
spi: spi-zynqmp-gqspi: Resolved slab-out-of-bounds bug
During a transfer the driver filled the fifo with 4bytes,
even if the data that needs to be transfer is less that 4bytes.
This resulted in slab-out-of-bounds bug in KernelAddressSanitizer.
This patch resolves slab-out-of-bounds bug by filling the fifo
with the number of bytes that needs to transferred.
Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
Link: https://lore.kernel.org/r/20210416004652.2975446-4-quanyang.wang@windriver.com
Signed-off-by: Mark Brown <broonie@kernel.org>
| -rw-r--r-- | drivers/spi/spi-zynqmp-gqspi.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c index 1146359528b9..2e2607b5dee9 100644 --- a/drivers/spi/spi-zynqmp-gqspi.c +++ b/drivers/spi/spi-zynqmp-gqspi.c @@ -509,17 +509,19 @@ static void zynqmp_qspi_filltxfifo(struct zynqmp_qspi *xqspi, int size) u32 count = 0, intermediate; while ((xqspi->bytes_to_transfer > 0) && (count < size) && (xqspi->txbuf)) { - memcpy(&intermediate, xqspi->txbuf, 4); - zynqmp_gqspi_write(xqspi, GQSPI_TXD_OFST, intermediate); - if (xqspi->bytes_to_transfer >= 4) { + memcpy(&intermediate, xqspi->txbuf, 4); xqspi->txbuf += 4; xqspi->bytes_to_transfer -= 4; + count += 4; } else { + memcpy(&intermediate, xqspi->txbuf, + xqspi->bytes_to_transfer); xqspi->txbuf += xqspi->bytes_to_transfer; xqspi->bytes_to_transfer = 0; + count += xqspi->bytes_to_transfer; } - count++; + zynqmp_gqspi_write(xqspi, GQSPI_TXD_OFST, intermediate); } } |