linux-kernel - Re: [PATCH 3.12 037/107] spidev: fix hang when transfer_one

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMuHMdWVRTPSeVEAPTM7KLME4db0vfBYuH6N7pNoUwNPb0aZ7w@mail.gmail.com>
Date:	Thu, 20 Feb 2014 13:42:08 +0100
From:	Geert Uytterhoeven <geert@...ux-m68k.org>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	stable <stable@...r.kernel.org>,
	Daniel Santos <daniel.santos@...ox.com>,
	Mark Brown <broonie@...aro.org>
Subject: Re: [PATCH 3.12 037/107] spidev: fix hang when transfer_one_message fails

On Tue, Feb 11, 2014 at 8:05 PM, Greg Kroah-Hartman
<gregkh@...uxfoundation.org> wrote:
> 3.12-stable review patch.  If anyone has any objections, please let me know.

Sorry for not noticing this was queued up for stable before, but this
patch was reverted in mainline:

commit 1f802f8249a0da536877842c43c7204064c4de8b
Author: Geert Uytterhoeven <geert+renesas@...ux-m68k.org>
Date:   Tue Jan 28 10:33:03 2014 +0100

    spi: Fix crash with double message finalisation on error handling

    This reverts commit e120cc0dcf2880a4c5c0a6cb27b655600a1cfa1d.

    It causes a NULL pointer dereference with drivers using the generic
    spi_transfer_one_message(), which always calls
    spi_finalize_current_message(), which zeroes master->cur_msg.

    Drivers implementing transfer_one_message() theirselves must always call
    spi_finalize_current_message(), even if the transfer failed:

     * @transfer_one_message: the subsystem calls the driver to transfer a singl
     *      message while queuing transfers that arrive in the meantime. When th
     *      driver is finished with this message, it must call
     *      spi_finalize_current_message() so the subsystem can issue the next
     *      transfer

    Signed-off-by: Geert Uytterhoeven <geert+renesas@...ux-m68k.org>
    Signed-off-by: Mark Brown <broonie@...aro.org>

> ------------------
>
> From: Daniel Santos <daniel.santos@...ox.com>
>
> commit e120cc0dcf2880a4c5c0a6cb27b655600a1cfa1d upstream.
>
> This corrects a problem in spi_pump_messages() that leads to an spi
> message hanging forever when a call to transfer_one_message() fails.
> This failure occurs in my MCP2210 driver when the cs_change bit is set
> on the last transfer in a message, an operation which the hardware does
> not support.
>
> Rationale
> Since the transfer_one_message() returns an int, we must presume that it
> may fail.  If transfer_one_message() should never fail, it should return
> void.  Thus, calls to transfer_one_message() should properly manage a
> failure.
>
> Fixes: ffbbdd21329f3 (spi: create a message queueing infrastructure)
> Signed-off-by: Daniel Santos <daniel.santos@...ox.com>
> Signed-off-by: Mark Brown <broonie@...aro.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
>
> ---
>  drivers/spi/spi.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> --- a/drivers/spi/spi.c
> +++ b/drivers/spi/spi.c
> @@ -600,7 +600,9 @@ static void spi_pump_messages(struct kth
>         ret = master->transfer_one_message(master, master->cur_msg);
>         if (ret) {
>                 dev_err(&master->dev,
> -                       "failed to transfer one message from queue\n");
> +                       "failed to transfer one message from queue: %d\n", ret);
> +               master->cur_msg->status = ret;
> +               spi_finalize_current_message(master);
>                 return;
>         }
>  }

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/