spi: restore rx/tx_buf in case of unset CONFIG_HAS_DMA

The case where spi_master sets the flags SPI_MASTER_MUST_RX/TX while
CONFIG_HAS_DMA is unset (which is unlikley) together with a driver
that reuses spi_messages with rx/tx_buff set to NULL, can result in:
* data disclosure over the SPI (for tx_buf == NULL)
* memory corruption (for rx_buf == NULL)

This happenes when dummy_rx/dummy_tx are changing address due to krealloc
or free and an allocation of the memory by a different part of the kernel.

Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index d35c1a13217c542cfa8bab98a72fc751096850cb..cf8b91b23a763d60f8253e3ef1e8ccd420e52a0c 100644 (file)
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -571,7 +571,7 @@ static int __spi_map_msg(struct spi_master *master, struct spi_message *msg)
        return 0;
 }
 
-static int spi_unmap_msg(struct spi_master *master, struct spi_message *msg)
+static int __spi_unmap_msg(struct spi_master *master, struct spi_message *msg)
 {
        struct spi_transfer *xfer;
        struct device *tx_dev, *rx_dev;
@@ -583,15 +583,6 @@ static int spi_unmap_msg(struct spi_master *master, struct spi_message *msg)
        rx_dev = master->dma_rx->device->dev;
 
        list_for_each_entry(xfer, &msg->transfers, transfer_list) {
-               /*
-                * Restore the original value of tx_buf or rx_buf if they are
-                * NULL.
-                */
-               if (xfer->tx_buf == master->dummy_tx)
-                       xfer->tx_buf = NULL;
-               if (xfer->rx_buf == master->dummy_rx)
-                       xfer->rx_buf = NULL;
-
                if (!master->can_dma(master, msg->spi, xfer))
                        continue;
 
@@ -608,13 +599,32 @@ static inline int __spi_map_msg(struct spi_master *master,
        return 0;
 }
 
-static inline int spi_unmap_msg(struct spi_master *master,
-                               struct spi_message *msg)
+static inline int __spi_unmap_msg(struct spi_master *master,
+                                 struct spi_message *msg)
 {
        return 0;
 }
 #endif /* !CONFIG_HAS_DMA */
 
+static inline int spi_unmap_msg(struct spi_master *master,
+                               struct spi_message *msg)
+{
+       struct spi_transfer *xfer;
+
+       list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+               /*
+                * Restore the original value of tx_buf or rx_buf if they are
+                * NULL.
+                */
+               if (xfer->tx_buf == master->dummy_tx)
+                       xfer->tx_buf = NULL;
+               if (xfer->rx_buf == master->dummy_rx)
+                       xfer->rx_buf = NULL;
+       }
+
+       return __spi_unmap_msg(master, msg);
+}
+
 static int spi_map_msg(struct spi_master *master, struct spi_message *msg)
 {
        struct spi_transfer *xfer;