summaryrefslogtreecommitdiffstats
path: root/drivers/spi
diff options
context:
space:
mode:
authorGuennadi Liakhovetski <g.liakhovetski@gmx.de>2011-01-21 16:56:47 +0100
committerGrant Likely <grant.likely@secretlab.ca>2011-01-21 09:26:24 -0700
commit8a6afb9a950de01457a4267bcbe3292e56412326 (patch)
tree0db7d430e83675414aa97b23b1eb60726a59486d /drivers/spi
parentc56eb8fb6dccb83d9fe62fd4dc00c834de9bc470 (diff)
downloadlinux-8a6afb9a950de01457a4267bcbe3292e56412326.tar.bz2
spi/spi_sh_msiof: fix wrong address calculation, which leads to an Oops
NULL + <small offset> != NULL, but reading from that <small offset> address is usually not a very good idea and often leads to problems, like kernel Oopses in this case, easily reproducible by writing to an SD-card, used in SPI mode. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Diffstat (limited to 'drivers/spi')
-rw-r--r--drivers/spi/spi_sh_msiof.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/spi/spi_sh_msiof.c b/drivers/spi/spi_sh_msiof.c
index 56f60c8ea0ab..2c665fceaac7 100644
--- a/drivers/spi/spi_sh_msiof.c
+++ b/drivers/spi/spi_sh_msiof.c
@@ -509,9 +509,11 @@ static int sh_msiof_spi_txrx(struct spi_device *spi, struct spi_transfer *t)
bytes_done = 0;
while (bytes_done < t->len) {
+ void *rx_buf = t->rx_buf ? t->rx_buf + bytes_done : NULL;
+ const void *tx_buf = t->tx_buf ? t->tx_buf + bytes_done : NULL;
n = sh_msiof_spi_txrx_once(p, tx_fifo, rx_fifo,
- t->tx_buf + bytes_done,
- t->rx_buf + bytes_done,
+ tx_buf,
+ rx_buf,
words, bits);
if (n < 0)
break;