diff options
| author | Tamura Dai <kirinode0@gmail.com> | 2025-04-17 10:16:05 +0900 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-05-02 07:59:28 +0200 |
| commit | 185d376875ea6fb4256b9dc97ee0b4d2b0fdd399 (patch) | |
| tree | 2ff6fafe27419eb48c96396658f6aafd30e4c6b8 | |
| parent | 54cbce4fe04bc6793178a3daff70fba2acbf7644 (diff) | |
| download | linux-185d376875ea6fb4256b9dc97ee0b4d2b0fdd399.tar.gz linux-185d376875ea6fb4256b9dc97ee0b4d2b0fdd399.tar.bz2 linux-185d376875ea6fb4256b9dc97ee0b4d2b0fdd399.zip | |
spi: spi-imx: Add check for spi_imx_setupxfer()
[ Upstream commit 951a04ab3a2db4029debfa48d380ef834b93207e ]
Add check for the return value of spi_imx_setupxfer().
spi_imx->rx and spi_imx->tx function pointer can be NULL when
spi_imx_setupxfer() return error, and make NULL pointer dereference.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Call trace:
0x0
spi_imx_pio_transfer+0x50/0xd8
spi_imx_transfer_one+0x18c/0x858
spi_transfer_one_message+0x43c/0x790
__spi_pump_transfer_message+0x238/0x5d4
__spi_sync+0x2b0/0x454
spi_write_then_read+0x11c/0x200
Signed-off-by: Tamura Dai <kirinode0@gmail.com>
Reviewed-by: Carlos Song <carlos.song@nxp.com>
Link: https://patch.msgid.link/20250417011700.14436-1-kirinode0@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/spi/spi-imx.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c index 4c31d36f3130..810541eed213 100644 --- a/drivers/spi/spi-imx.c +++ b/drivers/spi/spi-imx.c @@ -1614,10 +1614,13 @@ static int spi_imx_transfer_one(struct spi_controller *controller, struct spi_device *spi, struct spi_transfer *transfer) { + int ret; struct spi_imx_data *spi_imx = spi_controller_get_devdata(spi->controller); unsigned long hz_per_byte, byte_limit; - spi_imx_setupxfer(spi, transfer); + ret = spi_imx_setupxfer(spi, transfer); + if (ret < 0) + return ret; transfer->effective_speed_hz = spi_imx->spi_bus_clk; /* flush rxfifo before transfer */ |