spi/pxa2xx: fix memory corruption due to wrong size used in devm_kzalloc()
ACPI part of the driver accidentally used sizeof(*ssp) instead of the
correct sizeof(*pdata). This leads to nasty memory corruptions like the one
below:
BUG: unable to handle kernel paging request at
0000000749fd30b8
IP: [<
ffffffff813fe8a1>] __list_del_entry+0x31/0xd0
PGD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 30 Comm: kworker/0:1 Not tainted 3.10.0-rc6v3.10-rc6_sdhci_modprobe+ #443
task:
ffff8801483a0940 ti:
ffff88014839e000 task.ti:
ffff88014839e000
RIP: 0010:[<
ffffffff813fe8a1>] [<
ffffffff813fe8a1>] __list_del_entry+0x31/0xd0
RSP: 0000:
ffff88014839fde8 EFLAGS:
00010046
RAX:
ffff880149fd30b0 RBX:
ffff880149fd3040 RCX:
dead000000200200
RDX:
0000000749fd30b0 RSI:
ffff880149fd3058 RDI:
ffff88014834d640
RBP:
ffff88014839fde8 R08:
ffff88014834d640 R09:
0000000000000001
R10:
ffff8801483a0940 R11:
0000000000000001 R12:
ffff880149fd3040
R13:
ffffffff810e0b30 R14:
ffff8801483a0940 R15:
ffff88014834d640
FS:
0000000000000000(0000) GS:
ffff880149e00000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
0000000000000168 CR3:
0000000001e0b000 CR4:
00000000001407f0
DR0:
0000000000000000 DR1:
0000000000000000 DR2:
0000000000000000
DR3:
0000000000000000 DR6:
00000000ffff0ff0 DR7:
0000000000000400
Stack:
ffff88014839fe48 ffffffff810e0baf ffffffff81120abd ffff88014839fe20
ffff8801483a0940 ffff8801483a0940 ffff8801483a0940 ffff8801486b1c90
ffff88014834d640 ffffffff810e0b30 0000000000000000 0000000000000000
Call Trace:
[<
ffffffff810e0baf>] worker_thread+0x7f/0x390
[<
ffffffff81120abd>] ? trace_hardirqs_on+0xd/0x10
[<
ffffffff810e0b30>] ? manage_workers.isra.22+0x2b0/0x2b0
[<
ffffffff810e6c09>] kthread+0xd9/0xe0
[<
ffffffff810f93df>] ? local_clock+0x3f/0x50
[<
ffffffff810e6b30>] ? kthread_create_on_node+0x110/0x110
[<
ffffffff818c5dec>] ret_from_fork+0x7c/0xb0
[<
ffffffff810e6b30>] ? kthread_create_on_node+0x110/0x110
Fix this by using the right structure size in devm_kzalloc().
Reported-by: Jerome Blin <jerome.blin@intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org # 3.9+