kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/spi
History
Ian Abbott a53a7ec98e spi: spidev: fix possible arithmetic overflow for multi-transfer message 
commit f20fbaad76 upstream.

`spidev_message()` sums the lengths of the individual SPI transfers to
determine the overall SPI message length.  It restricts the total
length, returning an error if too long, but it does not check for
arithmetic overflow.  For example, if the SPI message consisted of two
transfers and the first has a length of 10 and the second has a length
of (__u32)(-1), the total length would be seen as 9, even though the
second transfer is actually very long.  If the second transfer specifies
a null `rx_buf` and a non-null `tx_buf`, the `copy_from_user()` could
overrun the spidev's pre-allocated tx buffer before it reaches an
invalid user memory address.  Fix it by checking that neither the total
nor the individual transfer lengths exceed the maximum allowed value.

Thanks to Dan Carpenter for reporting the potential integer overflow.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Mark Brown <broonie@kernel.org>
[ luis: backported to 3.16: used backport provided by Ian ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
History 2015-04-27 09:48:12 +01:00
..
Kconfig Merge remote-tracking branches 'spi/topic/adi', 'spi/topic/atmel' and 'spi/topic/cadence' into spi-next 2014-06-02 17:08:35 +01:00
Makefile Merge remote-tracking branches 'spi/topic/adi', 'spi/topic/atmel' and 'spi/topic/cadence' into spi-next 2014-06-02 17:08:35 +01:00
spi-adi-v3.c spi: spi-adi-v3: convert to use common clk framework 2014-04-14 17:45:25 +01:00
spi-altera.c Merge remote-tracking branches 'spi/topic/imx', 'spi/topic/init', 'spi/topic/mpc512x-psc', 'spi/topic/mpc52xx', 'spi/topic/mxs', 'spi/topic/nuc900', 'spi/topic/oc-tiny' and 'spi/topic/octeon' into spi-next 2014-03-30 00:51:17 +00:00
spi-ath79.c spi: Remove unneeded include of linux/workqueue.h 2014-04-14 17:20:15 +01:00
spi-atmel.c spi: atmel: Fix interrupt setup for PDC transfers 2015-03-23 15:16:06 +00:00
spi-au1550.c Merge branch 'mips-for-linux-next' of git://git.linux-mips.org/pub/scm/ralf/upstream-sfr 2014-04-02 13:40:50 -07:00
spi-bcm63xx-hsspi.c spi: Remove unneeded include of linux/workqueue.h 2014-04-14 17:20:15 +01:00
spi-bcm63xx.c spi: Remove unneeded include of linux/workqueue.h 2014-04-14 17:20:15 +01:00
spi-bcm2835.c spi: Remove explictly set bus_num and num_chipselect to default setting 2014-02-16 09:51:02 +08:00
spi-bfin-sport.c spi: delete non-required instances of include <linux/init.h> 2014-02-03 12:20:35 +00:00
spi-bfin5xx.c spi: bfin5xx: fix build error 2014-04-14 20:44:15 +01:00
spi-bitbang-txrx.h spi: bitbang: Grammar s/make to make/to make/ 2014-01-13 11:24:21 +00:00
spi-bitbang.c Merge remote-tracking branches 'spi/topic/imx', 'spi/topic/init', 'spi/topic/mpc512x-psc', 'spi/topic/mpc52xx', 'spi/topic/mxs', 'spi/topic/nuc900', 'spi/topic/oc-tiny' and 'spi/topic/octeon' into spi-next 2014-03-30 00:51:17 +00:00
spi-butterfly.c spi: bitbang: Make spi_bitbang_stop() return void 2014-03-29 11:09:26 +00:00
spi-cadence.c spi: Add driver for Cadence SPI controller 2014-04-14 21:00:28 +01:00
spi-clps711x.c Merge remote-tracking branches 'spi/topic/imx', 'spi/topic/init', 'spi/topic/mpc512x-psc', 'spi/topic/mpc52xx', 'spi/topic/mxs', 'spi/topic/nuc900', 'spi/topic/oc-tiny' and 'spi/topic/octeon' into spi-next 2014-03-30 00:51:17 +00:00
spi-coldfire-qspi.c Merge remote-tracking branches 'spi/topic/bus-num', 'spi/topic/cleanup', 'spi/topic/clps711x', 'spi/topic/coldfire', 'spi/topic/completion' and 'spi/topic/davinci' into spi-next 2014-03-30 00:51:03 +00:00
spi-davinci.c spi: davinci: Use of_match_ptr at appropriate place 2014-02-06 12:52:59 +00:00
spi-dw-mid.c spi: dw-mid: fix FIFO size 2015-02-04 10:58:00 +00:00
spi-dw-mmio.c spi: dw: add support for gpio controlled chip select 2014-04-24 18:09:05 +01:00
spi-dw-pci.c spi: dw-pci: fix bug when regs left uninitialized 2014-10-05 13:41:01 -07:00
spi-dw.c spi: dw: revisit FIFO size detection again 2015-03-23 15:16:00 +00:00
spi-dw.h spi: dw: add support for gpio controlled chip select 2014-04-24 18:09:05 +01:00
spi-efm32.c Merge remote-tracking branches 'spi/topic/drivers', 'spi/topic/dw', 'spi/topic/efm32', 'spi/topic/ep93xx', 'spi/topic/fsl', 'spi/topic/fsl-dspi', 'spi/topic/fsl-espi' and 'spi/topic/gpio' into spi-next 2014-03-30 00:51:10 +00:00
spi-ep93xx.c spi: ep93xx: Convert to let spi core handle checking transfer speed 2014-02-14 20:24:53 +00:00
spi-falcon.c spi: Remove unneeded include of linux/workqueue.h 2014-04-14 17:20:15 +01:00
spi-fsl-cpm.c DeviceTree updates for 3.13. This is a bit larger pull request than 2013-11-12 16:52:17 +09:00
spi-fsl-cpm.h spi/spi-fsl-spi: Make driver usable in CPU mode outside of an FSL_SOC environment 2013-04-07 10:07:54 +01:00
spi-fsl-dspi.c spi: spi-fsl-dspi: Remove usage of devm_kzalloc 2015-02-10 13:38:44 +00:00
spi-fsl-espi.c spi: fsl: Don't use devm_kzalloc in master->setup callback 2014-10-05 13:41:09 -07:00
spi-fsl-lib.c spi: fsl: Kill mpc8xxx_spi_cleanup and convert fsl_espi_setup to use devm_kzalloc 2014-04-14 17:18:55 +01:00
spi-fsl-lib.h spi: fsl: Kill mpc8xxx_spi_cleanup and convert fsl_espi_setup to use devm_kzalloc 2014-04-14 17:18:55 +01:00
spi-fsl-spi.c spi: fsl: Don't use devm_kzalloc in master->setup callback 2014-10-05 13:41:09 -07:00
spi-fsl-spi.h spi/spi-fsl-spi: Add support for Aeroflex Gaisler GRLIB cores normally running on SPARC 2013-04-07 10:07:56 +01:00
spi-gpio.c spi: spi-gpio: Make of_device_id array const 2014-05-07 20:53:04 +01:00
spi-imx.c Merge remote-tracking branches 'spi/topic/imx', 'spi/topic/init', 'spi/topic/mpc512x-psc', 'spi/topic/mpc52xx', 'spi/topic/mxs', 'spi/topic/nuc900', 'spi/topic/oc-tiny' and 'spi/topic/octeon' into spi-next 2014-03-30 00:51:17 +00:00
spi-lm70llp.c spi: bitbang: Let spi_bitbang_start() take a reference to master 2013-10-07 14:50:43 +01:00
spi-mpc52xx-psc.c Merge remote-tracking branches 'spi/fix/complete', 'spi/fix/efm32', 'spi/fix/omap2-mcspi' and 'spi/fix/qup' into spi-linus 2014-04-10 23:39:52 +01:00
spi-mpc52xx.c Merge remote-tracking branches 'spi/fix/complete', 'spi/fix/efm32', 'spi/fix/omap2-mcspi' and 'spi/fix/qup' into spi-linus 2014-04-10 23:39:52 +01:00
spi-mpc512x-psc.c Merge remote-tracking branches 'spi/fix/complete', 'spi/fix/efm32', 'spi/fix/omap2-mcspi' and 'spi/fix/qup' into spi-linus 2014-04-10 23:39:52 +01:00
spi-mxs.c Merge remote-tracking branches 'spi/topic/imx', 'spi/topic/init', 'spi/topic/mpc512x-psc', 'spi/topic/mpc52xx', 'spi/topic/mxs', 'spi/topic/nuc900', 'spi/topic/oc-tiny' and 'spi/topic/octeon' into spi-next 2014-03-30 00:51:17 +00:00
spi-nuc900.c spi: Remove unneeded include of linux/workqueue.h 2014-04-14 17:20:15 +01:00
spi-oc-tiny.c Merge remote-tracking branches 'spi/topic/imx', 'spi/topic/init', 'spi/topic/mpc512x-psc', 'spi/topic/mpc52xx', 'spi/topic/mxs', 'spi/topic/nuc900', 'spi/topic/oc-tiny' and 'spi/topic/octeon' into spi-next 2014-03-30 00:51:17 +00:00
spi-octeon.c Merge remote-tracking branches 'spi/topic/imx', 'spi/topic/init', 'spi/topic/mpc512x-psc', 'spi/topic/mpc52xx', 'spi/topic/mxs', 'spi/topic/nuc900', 'spi/topic/oc-tiny' and 'spi/topic/octeon' into spi-next 2014-03-30 00:51:17 +00:00
spi-omap-100k.c spi: omap-100k: Fix memory leak 2014-03-29 10:01:13 +00:00
spi-omap-uwire.c spi: Remove unneeded include of linux/workqueue.h 2014-04-14 17:20:15 +01:00
spi-omap2-mcspi.c spi/omap-mcspi: Fix the spi task hangs waiting dma_rx 2014-10-05 13:41:01 -07:00
spi-orion.c spi: orion: fix incorrect handling of cell-index DT property 2014-09-17 09:21:51 -07:00
spi-pl022.c spi: pl022: Fix race in giveback() leading to driver lock-up 2015-03-23 15:16:31 +00:00
spi-ppc4xx.c spi: delete non-required instances of include <linux/init.h> 2014-02-03 12:20:35 +00:00
spi-pxa2xx-dma.c spi/pxa2xx: change default supported DMA burst size to 1 2014-06-06 10:52:46 +01:00
spi-pxa2xx-pci.c spi/pxa2xx-pci: Add PCI mode support for BayTrail LPSS SPI 2014-04-18 18:06:07 +01:00
spi-pxa2xx-pxadma.c spi: delete non-required instances of include <linux/init.h> 2014-02-03 12:20:35 +00:00
spi-pxa2xx.c spi/pxa2xx: Clear cur_chip pointer before starting next message 2015-02-04 10:57:58 +00:00
spi-pxa2xx.h spi/pxa2xx: add support for Intel Low Power Subsystem SPI 2013-02-08 13:14:40 +00:00
spi-qup.c spi: qup: Fix cs-num DT property parsing 2015-04-10 10:03:54 +01:00
spi-rspi.c spi: rspi: Extract rspi_common_transfer() 2014-06-02 15:49:36 +01:00
spi-s3c24xx-fiq.h spi: reorganize drivers 2011-06-06 01:16:30 -06:00
spi-s3c24xx-fiq.S spi: reorganize drivers 2011-06-06 01:16:30 -06:00
spi-s3c24xx.c Merge remote-tracking branch 'spi/topic/workqueue' into spi-next 2014-06-02 17:08:43 +01:00
spi-s3c64xx.c Merge remote-tracking branch 'spi/topic/workqueue' into spi-next 2014-06-02 17:08:43 +01:00
spi-sc18is602.c spi: sc18is602: Convert to let spi core validate transfer speed 2014-03-13 09:47:05 +00:00
spi-sh-hspi.c spi: sh-hspi: Do not specifically request shyway_clk clock 2014-04-14 21:14:54 +01:00
spi-sh-msiof.c spi: sh-msiof: Add runtime PM lock in initializing 2015-01-15 22:41:19 +00:00
spi-sh-sci.c spi: sh-sci: fix use-after-free in sh_sci_spi_remove() 2014-06-17 15:47:31 +01:00
spi-sh.c spi: Always check complete callback before calling it 2014-04-03 11:13:38 +01:00
spi-sirf.c spi: sirf: fix word width configuration 2014-12-10 17:14:51 +00:00
spi-sun4i.c spi: Remove unneeded include of linux/workqueue.h 2014-04-14 17:20:15 +01:00
spi-sun6i.c spi: Remove unneeded include of linux/workqueue.h 2014-04-14 17:20:15 +01:00
spi-tegra20-sflash.c spi: tegra20-sflash: Make of_device_id array const 2014-05-07 20:53:05 +01:00
spi-tegra20-slink.c spi: tegra20-slink: Make of_device_id array const 2014-05-07 20:53:05 +01:00
spi-tegra114.c spi: tegra114: Make of_device_id array const 2014-05-07 20:53:05 +01:00
spi-ti-qspi.c Merge remote-tracking branches 'spi/topic/sunxi', 'spi/topic/tegra114', 'spi/topic/ti-qspi', 'spi/topic/ti-ssp', 'spi/topic/topcliff-pch', 'spi/topic/txx9', 'spi/topic/xcomm' and 'spi/topic/xfer' into spi-next 2014-03-30 00:51:41 +00:00
spi-tle62x0.c spi: tle62x0: remove unnecessary OOM messages 2014-04-29 12:01:42 -07:00
spi-topcliff-pch.c spi: topcliff-pch: remove unnecessary OOM messages 2014-04-29 12:01:42 -07:00
spi-txx9.c Merge remote-tracking branches 'spi/fix/complete', 'spi/fix/efm32', 'spi/fix/omap2-mcspi' and 'spi/fix/qup' into spi-linus 2014-04-10 23:39:52 +01:00
spi-xcomm.c Merge remote-tracking branches 'spi/topic/sunxi', 'spi/topic/tegra114', 'spi/topic/ti-qspi', 'spi/topic/ti-ssp', 'spi/topic/topcliff-pch', 'spi/topic/txx9', 'spi/topic/xcomm' and 'spi/topic/xfer' into spi-next 2014-03-30 00:51:41 +00:00
spi-xilinx.c Merge remote-tracking branches 'spi/topic/xilinx' and 'spi/topic/xtfpga' into spi-next 2014-03-30 00:51:48 +00:00
spi-xtensa-xtfpga.c spi: add xtfpga SPI controller driver 2014-03-13 09:12:44 +00:00
spi.c spi: trigger trace event for message-done before mesg->complete 2015-04-10 10:03:57 +01:00
spidev.c spi: spidev: fix possible arithmetic overflow for multi-transfer message 2015-04-27 09:48:12 +01:00