summaryrefslogtreecommitdiffstats
path: root/drivers/spi
diff options
context:
space:
mode:
authorJoakim Tjernlund <Joakim.Tjernlund@transmode.se>2010-05-22 02:18:02 -0600
committerGrant Likely <grant.likely@secretlab.ca>2010-05-22 02:18:02 -0600
commitf9218c2a60facc6ff9a793a9d9ab956194d70012 (patch)
tree03876aab569a848ee44b741fd389856738470148 /drivers/spi
parente40152ee1e1c7a63f4777791863215e3faa37a86 (diff)
downloadlinux-f9218c2a60facc6ff9a793a9d9ab956194d70012.tar.bz2
spi/spi_mpc8xxx: fix potential memory corruption.
tx_dma/rx_dma are already set to a dummy buffer when no tx/rx buffer and t->tx_dma/t->rx_dma does not contain a dma address, but NULL. This may lead to corruption of kernel memory. Fix this by leaving tx_dma/rx_dma alone. Do not INIT_TX_RX while controller is enabled, this is bad according to the MPC8321 manual. Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se> Acked-by: Anton Vorontsov <cbouatmailru@gmail.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Diffstat (limited to 'drivers/spi')
-rw-r--r--drivers/spi/spi_mpc8xxx.c7
1 files changed, 3 insertions, 4 deletions
diff --git a/drivers/spi/spi_mpc8xxx.c b/drivers/spi/spi_mpc8xxx.c
index 14d052316502..0dfc482bbff5 100644
--- a/drivers/spi/spi_mpc8xxx.c
+++ b/drivers/spi/spi_mpc8xxx.c
@@ -241,7 +241,6 @@ static void mpc8xxx_spi_change_mode(struct spi_device *spi)
/* Turn off SPI unit prior changing mode */
mpc8xxx_spi_write_reg(mode, cs->hw_mode & ~SPMODE_ENABLE);
- mpc8xxx_spi_write_reg(mode, cs->hw_mode);
/* When in CPM mode, we need to reinit tx and rx. */
if (mspi->flags & SPI_CPM_MODE) {
@@ -258,7 +257,7 @@ static void mpc8xxx_spi_change_mode(struct spi_device *spi)
}
}
}
-
+ mpc8xxx_spi_write_reg(mode, cs->hw_mode);
local_irq_restore(flags);
}
@@ -438,7 +437,7 @@ static int mpc8xxx_spi_cpm_bufs(struct mpc8xxx_spi *mspi,
dev_err(dev, "unable to map tx dma\n");
return -ENOMEM;
}
- } else {
+ } else if (t->tx_buf) {
mspi->tx_dma = t->tx_dma;
}
@@ -449,7 +448,7 @@ static int mpc8xxx_spi_cpm_bufs(struct mpc8xxx_spi *mspi,
dev_err(dev, "unable to map rx dma\n");
goto err_rx_dma;
}
- } else {
+ } else if (t->rx_buf) {
mspi->rx_dma = t->rx_dma;
}