Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-12 22:23:55 +00:00
Code Issues Packages Projects Releases Wiki Activity
f20fbaad76
linux/drivers/spi
History
Ian Abbott f20fbaad76 spi: spidev: fix possible arithmetic overflow for multi-transfer message 
`spidev_message()` sums the lengths of the individual SPI transfers to
determine the overall SPI message length.  It restricts the total
length, returning an error if too long, but it does not check for
arithmetic overflow.  For example, if the SPI message consisted of two
transfers and the first has a length of 10 and the second has a length
of (__u32)(-1), the total length would be seen as 9, even though the
second transfer is actually very long.  If the second transfer specifies
a null `rx_buf` and a non-null `tx_buf`, the `copy_from_user()` could
overrun the spidev's pre-allocated tx buffer before it reaches an
invalid user memory address.  Fix it by checking that neither the total
nor the individual transfer lengths exceed the maximum allowed value.

Thanks to Dan Carpenter for reporting the potential integer overflow.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Mark Brown <broonie@kernel.org>
2015-03-23 14:00:51 -07:00
..
Kconfig Merge branch 'kconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild 2015-02-19 10:36:45 -08:00
Makefile Merge remote-tracking branches 'spi/topic/sirf', 'spi/topic/spidev', 'spi/topic/st-ssc' and 'spi/topic/ti-qspi' into spi-next 2015-02-08 11:16:58 +08:00
spi-adi-v3.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-altera.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-ath79.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-atmel.c spi: atmel: cleanup wait_for_completion return handling 2015-02-04 11:26:03 +00:00
spi-au1550.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-bcm53xx.c treewide: Remove unnecessary BCMA_CORETABLE_END macro 2015-02-11 14:38:28 -08:00
spi-bcm53xx.h spi: bcm53xx: driver for SPI controller on Broadcom bcma SoC 2014-08-19 11:30:55 -05:00
spi-bcm63xx-hsspi.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-bcm63xx.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-bcm2835.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-bfin5xx.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-bfin-sport.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-bitbang-txrx.h spi: bitbang: Grammar s/make to make/to make/ 2014-01-13 11:24:21 +00:00
spi-bitbang.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-butterfly.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-cadence.c Merge remote-tracking branches 'spi/topic/atmel', 'spi/topic/cadence', 'spi/topic/dw' and 'spi/topic/fsl-cpm' into spi-next 2014-12-08 12:17:12 +00:00
spi-clps711x.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-coldfire-qspi.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-davinci.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-dln2.c spi/dln2: simplify return flow for dln2_spi_transfer_setup and dln2_spi_enable 2015-01-06 17:02:50 +00:00
spi-dw-mid.c spi: dw-mid: get a proper clock frequency for SPI2 2015-01-27 12:04:29 +00:00
spi-dw-mmio.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-dw-pci.c spi: dw-mid: get a proper clock frequency for SPI2 2015-01-27 12:04:29 +00:00
spi-dw.c spi: dw: print debug message with FIFO size 2015-01-07 18:01:06 +00:00
spi-dw.h spi: dw-mid: split rx and tx callbacks when DMA 2014-10-28 22:40:38 +00:00
spi-efm32.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-ep93xx.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-falcon.c Merge remote-tracking branches 'spi/topic/falcon', 'spi/topic/fsf', 'spi/topic/fsl', 'spi/topic/fsl-dspi' and 'spi/topic/gpio' into spi-next 2015-02-08 11:16:46 +08:00
spi-fsl-cpm.c spi: fsl-(e)spi: Support compile as module 2015-01-06 17:03:34 +00:00
spi-fsl-cpm.h spi/spi-fsl-spi: Make driver usable in CPU mode outside of an FSL_SOC environment 2013-04-07 10:07:54 +01:00
spi-fsl-dspi.c spi: fsl-dspi: Remove possible memory leak of 'chip' 2015-02-02 20:05:19 +00:00
spi-fsl-espi.c Driver core patches for 3.19-rc1 2014-12-14 16:10:09 -08:00
spi-fsl-lib.c spi: fsl-(e)spi: Support compile as module 2015-01-06 17:03:34 +00:00
spi-fsl-lib.h spi: fsl-(e)spi: Support compile as module 2015-01-06 17:03:34 +00:00
spi-fsl-spi.c Driver core patches for 3.19-rc1 2014-12-14 16:10:09 -08:00
spi-fsl-spi.h spi/spi-fsl-spi: Add support for Aeroflex Gaisler GRLIB cores normally running on SPARC 2013-04-07 10:07:56 +01:00
spi-gpio.c Merge remote-tracking branches 'spi/topic/falcon', 'spi/topic/fsf', 'spi/topic/fsl', 'spi/topic/fsl-dspi' and 'spi/topic/gpio' into spi-next 2015-02-08 11:16:46 +08:00
spi-img-spfi.c spi: img-spfi: Select FIFO based on transfer length 2014-12-24 12:20:22 +00:00
spi-imx.c Merge remote-tracking branches 'spi/topic/img-spfi', 'spi/topic/imx', 'spi/topic/inline', 'spi/topic/meson' and 'spi/topic/mxs' into spi-next 2015-02-08 11:16:52 +08:00
spi-lm70llp.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-meson-spifc.c spi: meson: Constify struct regmap_config 2015-01-05 20:11:32 +00:00
spi-mpc52xx-psc.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-mpc52xx.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-mpc512x-psc.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-mxs.c spi: mxs: cleanup wait_for_completion return handling 2015-02-05 18:04:57 +00:00
spi-nuc900.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-oc-tiny.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-octeon.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-omap2-mcspi.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-omap-100k.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-omap-uwire.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-orion.c spi: orion: Add multiple chip select support to spi-orion 2015-01-16 12:38:54 +00:00
spi-pl022.c PM: Merge the SET*_RUNTIME_PM_OPS() macros 2014-12-04 00:51:30 +01:00
spi-ppc4xx.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-pxa2xx-dma.c spi: pxa2xx: Cleanup register access macros 2014-12-22 20:17:23 +00:00
spi-pxa2xx-pci.c spi: spi-pxa2xx: SPI support for Intel Quark X1000 2014-11-26 18:07:45 +00:00
spi-pxa2xx-pxadma.c Merge remote-tracking branches 'spi/topic/orion', 'spi/topic/pxa2xx', 'spi/topic/qup', 'spi/topic/rockchip' and 'spi/topic/samsung' into spi-next 2015-02-08 11:16:55 +08:00
spi-pxa2xx.c Merge remote-tracking branches 'spi/topic/orion', 'spi/topic/pxa2xx', 'spi/topic/qup', 'spi/topic/rockchip' and 'spi/topic/samsung' into spi-next 2015-02-08 11:16:55 +08:00
spi-pxa2xx.h spi: pxa2xx: Cleanup register access macros 2014-12-22 20:17:23 +00:00
spi-qup.c spi: qup: Add SPI_CPOL configuration support 2014-12-29 17:14:21 +00:00
spi-rockchip.c spi/rockchip: avoid uninitialized-use warning 2015-01-28 17:36:37 +00:00
spi-rspi.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-s3c24xx-fiq.h
spi-s3c24xx-fiq.S
spi-s3c24xx.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-s3c64xx.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-sc18is602.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-sh-hspi.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-sh-msiof.c spi: sh-msiof: cleanup wait_for_completion return handling 2015-02-04 20:52:53 +00:00
spi-sh-sci.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-sh.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-sirf.c spi: sirf: drop redundant sirf,marco-spi compatible string 2015-01-06 17:38:59 +00:00
spi-st-ssc4.c spi: st-ssc4: Remove duplicate code to test unsupported mode bits 2015-01-14 19:16:56 +00:00
spi-sun4i.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-sun6i.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-tegra20-sflash.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-tegra20-slink.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-tegra114.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi-ti-qspi.c spi: ti-qspi: cleanup wait_for_completion return handling 2015-02-05 18:04:03 +00:00
spi-tle62x0.c spi: tle62x0: remove unnecessary OOM messages 2014-04-29 12:01:42 -07:00
spi-topcliff-pch.c spi: Remove FSF mailing addresses 2014-12-22 15:32:42 +00:00
spi-txx9.c Driver core patches for 3.19-rc1 2014-12-14 16:10:09 -08:00
spi-xcomm.c Merge remote-tracking branches 'spi/topic/sunxi', 'spi/topic/tegra114', 'spi/topic/ti-qspi', 'spi/topic/ti-ssp', 'spi/topic/topcliff-pch', 'spi/topic/txx9', 'spi/topic/xcomm' and 'spi/topic/xfer' into spi-next 2014-03-30 00:51:41 +00:00
spi-xilinx.c spi/xilinx: Fix access invalid memory on xilinx_spi_tx 2015-02-02 12:17:19 +00:00
spi-xtensa-xtfpga.c spi: drop owner assignment from platform_drivers 2014-10-20 16:21:36 +02:00
spi.c Merge remote-tracking branches 'spi/topic/img-spfi', 'spi/topic/imx', 'spi/topic/inline', 'spi/topic/meson' and 'spi/topic/mxs' into spi-next 2015-02-08 11:16:52 +08:00
spidev.c spi: spidev: fix possible arithmetic overflow for multi-transfer message 2015-03-23 14:00:51 -07:00