]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers
authorMarc Kleine-Budde <mkl@pengutronix.de>
Tue, 19 Jul 2022 07:22:35 +0000 (09:22 +0200)
committerStefan Bader <stefan.bader@canonical.com>
Fri, 16 Sep 2022 08:53:27 +0000 (10:53 +0200)
commit760924bf85afa1e0153f7787458d85b8fd7ca6f2
tree196475164fada5d3f19581fb24ab2836a11af1a7
parent68310825a41b2b27e7b44863211feac9c1065e9a
spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers

BugLink: https://bugs.launchpad.net/bugs/1988479
commit 4ceaa684459d414992acbefb4e4c31f2dfc50641 upstream.

In case a IRQ based transfer times out the bcm2835_spi_handle_err()
function is called. Since commit 1513ceee70f2 ("spi: bcm2835: Drop
dma_pending flag") the TX and RX DMA transfers are unconditionally
canceled, leading to NULL pointer derefs if ctlr->dma_tx or
ctlr->dma_rx are not set.

Fix the NULL pointer deref by checking that ctlr->dma_tx and
ctlr->dma_rx are valid pointers before accessing them.

Fixes: 1513ceee70f2 ("spi: bcm2835: Drop dma_pending flag")
Cc: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Link: https://lore.kernel.org/r/20220719072234.2782764-1-mkl@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
drivers/spi/spi-bcm2835.c