• Martin Sperl's avatar
    spi: restore rx/tx_buf in case of unset CONFIG_HAS_DMA · 4b786458
    Martin Sperl authored
    The case where spi_master sets the flags SPI_MASTER_MUST_RX/TX while
    CONFIG_HAS_DMA is unset (which is unlikley) together with a driver
    that reuses spi_messages with rx/tx_buff set to NULL, can result in:
    * data disclosure over the SPI (for tx_buf == NULL)
    * memory corruption (for rx_buf == NULL)
    
    This happenes when dummy_rx/dummy_tx are changing address due to krealloc
    or free and an allocation of the memory by a different part of the kernel.
    Signed-off-by: default avatarMartin Sperl <kernel@martin.sperl.org>
    Signed-off-by: default avatarMark Brown <broonie@kernel.org>
    4b786458
spi.c 63.2 KB