Unverified Commit 2530b3df authored by Amit Kumar Mahapatra's avatar Amit Kumar Mahapatra Committed by Mark Brown
Browse files

spi: spi-zynqmp-gqspi: Resolved slab-out-of-bounds bug 



During a transfer the driver filled the fifo with 4bytes,
even if the data that needs to be transfer is less that 4bytes.
This resulted in slab-out-of-bounds bug in KernelAddressSanitizer.

This patch resolves slab-out-of-bounds bug by filling the fifo
with the number of bytes that needs to transferred.

Signed-off-by: default avatarAmit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
Link: https://lore.kernel.org/r/20210416004652.2975446-4-quanyang.wang@windriver.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 799f923f

drivers/spi/spi-zynqmp-gqspi.c

+6 −4
Original line number Diff line number Diff line
@@ -509,17 +509,19 @@ static void zynqmp_qspi_filltxfifo(struct zynqmp_qspi *xqspi, int size) 
	u32 count = 0, intermediate;



	while ((xqspi->bytes_to_transfer > 0) && (count < size) && (xqspi->txbuf)) {

		memcpy(&intermediate, xqspi->txbuf, 4);

		zynqmp_gqspi_write(xqspi, GQSPI_TXD_OFST, intermediate);



		if (xqspi->bytes_to_transfer >= 4) {

			memcpy(&intermediate, xqspi->txbuf, 4);

			xqspi->txbuf += 4;

			xqspi->bytes_to_transfer -= 4;

			count += 4;

		} else {

			memcpy(&intermediate, xqspi->txbuf,

			       xqspi->bytes_to_transfer);

			xqspi->txbuf += xqspi->bytes_to_transfer;

			xqspi->bytes_to_transfer = 0;

			count += xqspi->bytes_to_transfer;

		}

		count++;

		zynqmp_gqspi_write(xqspi, GQSPI_TXD_OFST, intermediate);

	}

}