summaryrefslogtreecommitdiffstats
path: root/drivers/spi
diff options
context:
space:
mode:
authorDongCV <cv-dong@jinso.co.jp>2017-02-15 19:50:51 +0900
committerMark Brown <broonie@kernel.org>2017-02-16 18:25:21 +0000
commit7264abc7000d601726aefb05189ea524ee3995ba (patch)
tree1e89e1ebca055a765e0298a7c014f016c1426fd1 /drivers/spi
parentfafd67940774733fa97f4b09412aea6981b82e0a (diff)
downloadlinux-7264abc7000d601726aefb05189ea524ee3995ba.tar.bz2
spi: rspi: Fixes bogus received byte in qspi_transfer_in()
In qspi_transfer_in(), when receiving the last n (or len) bytes of data, one bogus byte was written in the receive buffer. This code leads to a buffer overflow. "jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x03b40000: 0x1900 instead jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x03b40004: 0x000c instead" The error message above happens when trying to mount, unmount, and remount a jffs2-formatted device. This patch removed the bogus write to fixes: 3be09bec42a800d4 "spi: rspi: supports 32bytes buffer for DUAL and QUAD" And here is Geert's comment: "spi: rspi: Fix bogus received byte in qspi_transfer_in() When there are less than QSPI_BUFFER_SIZE remaining bytes to be received, qspi_transfer_in() writes one bogus byte in the receive buffer, possibly leading to a buffer overflow. This can be reproduced by mounting, unmounting, and remounting a jffs2-formatted device, causing lots of warnings like: "jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x03b40000: 0x1900 instead" Remove the bogus write to fix this. " Signed-off-by: DongCV <cv-dong@jinso.co.jp> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'drivers/spi')
-rw-r--r--drivers/spi/spi-rspi.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 9daf50031737..2ee130138066 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -848,7 +848,6 @@ static int qspi_transfer_in(struct rspi_data *rspi, struct spi_transfer *xfer)
ret = rspi_pio_transfer(rspi, NULL, rx, n);
if (ret < 0)
return ret;
- *rx++ = ret;
}
n -= len;
}