From 38ec10f60d9ca3a7eb3a5b52500a67479296b86f Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Sat, 16 Aug 2014 16:27:41 +0100 Subject: spi: Only call transfer_one() if we have buffers to transfer Client drivers such as the ChomeOS EC driver sometimes use transfers with no buffers and only a delay specified in order to allow a delay after the assertion of /CS. Rather than require controller drivers handle this noop case gracefully put checks in the core to ensure that we don't call into the controller for such transfers. Reported-by: Addy Ke Tested-by: Doug Anderson Reviewed-by: Doug Anderson Signed-off-by: Mark Brown --- drivers/spi/spi.c | 44 ++++++++++++++++++++++++++------------------ 1 file changed, 26 insertions(+), 18 deletions(-) (limited to 'drivers/spi') diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index e0531ba..0edccc8 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -789,27 +789,35 @@ static int spi_transfer_one_message(struct spi_master *master, list_for_each_entry(xfer, &msg->transfers, transfer_list) { trace_spi_transfer_start(msg, xfer); - reinit_completion(&master->xfer_completion); - - ret = master->transfer_one(master, msg->spi, xfer); - if (ret < 0) { - dev_err(&msg->spi->dev, - "SPI transfer failed: %d\n", ret); - goto out; - } + if (xfer->tx_buf || xfer->rx_buf) { + reinit_completion(&master->xfer_completion); + + ret = master->transfer_one(master, msg->spi, xfer); + if (ret < 0) { + dev_err(&msg->spi->dev, + "SPI transfer failed: %d\n", ret); + goto out; + } - if (ret > 0) { - ret = 0; - ms = xfer->len * 8 * 1000 / xfer->speed_hz; - ms += ms + 100; /* some tolerance */ + if (ret > 0) { + ret = 0; + ms = xfer->len * 8 * 1000 / xfer->speed_hz; + ms += ms + 100; /* some tolerance */ - ms = wait_for_completion_timeout(&master->xfer_completion, - msecs_to_jiffies(ms)); - } + ms = wait_for_completion_timeout(&master->xfer_completion, + msecs_to_jiffies(ms)); + } - if (ms == 0) { - dev_err(&msg->spi->dev, "SPI transfer timed out\n"); - msg->status = -ETIMEDOUT; + if (ms == 0) { + dev_err(&msg->spi->dev, + "SPI transfer timed out\n"); + msg->status = -ETIMEDOUT; + } + } else { + if (xfer->len) + dev_err(&msg->spi->dev, + "Bufferless transfer has length %u\n", + xfer->len); } trace_spi_transfer_stop(msg, xfer); -- cgit v1.1 From c7908a37aeee2a038d7b1492eae29750d8738d2e Mon Sep 17 00:00:00 2001 From: Xiubo Li Date: Wed, 24 Sep 2014 14:30:29 +0800 Subject: spi: Fix possible ZERO_SIZE_PTR pointer dereferencing error. Since we cannot make sure the 'n' will always be none zero here, and then if either equal to zero, the kzalloc() will return ZERO_SIZE_PTR, which equals to ((void *)16). So this patch fix this with just doing the zero check before calling kzalloc(). Signed-off-by: Xiubo Li Signed-off-by: Mark Brown --- drivers/spi/spi.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers/spi') diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 0edccc8..cc83cdd 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -552,6 +552,9 @@ int spi_register_board_info(struct spi_board_info const *info, unsigned n) struct boardinfo *bi; int i; + if (!n) + return -EINVAL; + bi = kzalloc(n * sizeof(*bi), GFP_KERNEL); if (!bi) return -ENOMEM; -- cgit v1.1