lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 18 May 2017 03:01:12 -0700 From: <jiada_wang@...tor.com> To: <broonie@...nel.org> CC: <linux-spi@...r.kernel.org>, <linux-kernel@...r.kernel.org>, <leonard.crestez@....com>, Jiada Wang <jiada_wang@...tor.com> Subject: [PATCH 1/1] spi: imx: fix issue when tx_buf or rx_buf is NULL From: Jiada Wang <jiada_wang@...tor.com> In case either transfer->tx_buf or transfer->rx_buf is NULL, manipulation of buffer in spi_imx_u32_swap_u[8|16]() will cause NULL pointer dereference crash. Add buffer check at very beginning of spi_imx_u32_swap_u[8|16](), to avoid such crash. Signed-off-by: Jiada Wang <jiada_wang@...tor.com> Reported-by: Leonard Crestez <leonard.crestez@....com> --- drivers/spi/spi-imx.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c index 782045f..19b30cf 100644 --- a/drivers/spi/spi-imx.c +++ b/drivers/spi/spi-imx.c @@ -288,6 +288,9 @@ static void spi_imx_u32_swap_u8(struct spi_transfer *transfer, u32 *buf) { int i; + if (!buf) + return; + for (i = 0; i < transfer->len / 4; i++) *(buf + i) = cpu_to_be32(*(buf + i)); } @@ -296,6 +299,9 @@ static void spi_imx_u32_swap_u16(struct spi_transfer *transfer, u32 *buf) { int i; + if (!buf) + return; + for (i = 0; i < transfer->len / 4; i++) { u16 *temp = (u16 *)buf; -- 2.7.4
Powered by blists - more mailing lists