diff options
| author | Peter Korsgaard <jacmet@sunsite.dk> | 2008-09-13 02:33:15 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-09-13 14:41:51 -0700 |
| commit | aa77d96ba94326db4f50d2aa36602824dd03286a (patch) | |
| tree | 4c2daacecb7f707d0ecf8569faf14f01d17a5e1e | |
| parent | 53604dbe1371c3c4458c2d741adbd8cfd8fe8e79 (diff) | |
spi_mpc83xx: reject invalid transfer sizes
Error out on transfer length != multiple of bytes per word with -EINVAL.
Fixes a buffer overrun crash if length < bytes per word.
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Acked-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | drivers/spi/spi_mpc83xx.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c index ab7ee445d8b..ac0e3e4b3c5 100644 --- a/drivers/spi/spi_mpc83xx.c +++ b/drivers/spi/spi_mpc83xx.c @@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_device *spi, struct spi_transfer *t) if (t->bits_per_word) bits_per_word = t->bits_per_word; len = t->len; - if (bits_per_word > 8) + if (bits_per_word > 8) { + /* invalid length? */ + if (len & 1) + return -EINVAL; len /= 2; - if (bits_per_word > 16) + } + if (bits_per_word > 16) { + /* invalid length? */ + if (len & 1) + return -EINVAL; len /= 2; + } mpc83xx_spi->count = len; + INIT_COMPLETION(mpc83xx_spi->done); /* enable rx ints */ |