linux-kernel - [PATCH 3.2 12/87] wlcore: SPI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 08 Feb 2016 23:53:51 +0000
From:	Ben Hutchings <ben@...adent.org.uk>
To:	linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:	akpm@...ux-foundation.org, "Luciano Coelho" <luca@...lho.fi>,
	"Janusz.Dziedzic@...to.com" <Janusz.Dziedzic@...to.com>,
	"Janusz Dziedzic" <janusz.dziedzic@...to.com>
Subject: [PATCH 3.2 12/87] wlcore: SPI - fix spi transfer_list

3.2.77-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: "Janusz.Dziedzic@...to.com" <Janusz.Dziedzic@...to.com>

commit 4eeac22c159f053ea34527e4fea359ab10b4b5a5 upstream.

In corner case for wl12xx_spi_raw_write() when
	len == SPI_AGGR_BUFFER_SIZE
we don't setup correctly spi transfer_list.
Next we will have garbage and strange errors
reported by SPI framework (eg. wrong speed_hz,
failed to transfer one message from queue)
when iterate transfer_list.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@...to.com>
Signed-off-by: Luciano Coelho <luca@...lho.fi>
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
 drivers/net/wireless/wl12xx/spi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -274,7 +274,7 @@ static void wl1271_spi_raw_read(struct w
 static void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
 			  size_t len, bool fixed)
 {
-	struct spi_transfer t[2 * WSPI_MAX_NUM_OF_CHUNKS];
+	struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS + 1)];
 	struct spi_message m;
 	u32 commands[WSPI_MAX_NUM_OF_CHUNKS];
 	u32 *cmd;