spi: Fix zero length xfer bug

BugLink: https://bugs.launchpad.net/bugs/1837517
[ Upstream commit 5442dcaa0d90fc376bdfc179a018931a8f43dea4 ]

This fixes a bug for messages containing both zero length and
unidirectional xfers.

The function spi_map_msg will allocate dummy tx and/or rx buffers
for use with unidirectional transfers when the hardware can only do
a bidirectional transfer.  That dummy buffer will be used in place
of a NULL buffer even when the xfer length is 0.

Then in the function __spi_map_msg, if he hardware can dma,
the zero length xfer will have spi_map_buf called on the dummy
buffer.

Eventually, __sg_alloc_table is called and returns -EINVAL
because nents == 0.

This fix prevents the error by not using the dummy buffer when
the xfer length is zero.

Signed-off-by: Chris Lesiak <chris.lesiak@licor.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 41f3e389c0acca3c0ce699933320f8f0aa275a8b..8f3429cd6635d7102384d501eef6d9b512be7a0d 100644 (file)
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1038,6 +1038,8 @@ static int spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
                if (max_tx || max_rx) {
                        list_for_each_entry(xfer, &msg->transfers,
                                            transfer_list) {
+                               if (!xfer->len)
+                                       continue;
                                if (!xfer->tx_buf)
                                        xfer->tx_buf = ctlr->dummy_tx;
                                if (!xfer->rx_buf)