projects
/
platform
/
adaptation
/
renesas_rcar
/
renesas_kernel.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
5548f98
)
spi/pxa2xx: fix memory corruption due to wrong size used in devm_kzalloc()
author
Mika Westerberg
<mika.westerberg@linux.intel.com>
Thu, 20 Jun 2013 14:44:22 +0000
(17:44 +0300)
committer
Mark Brown
<broonie@linaro.org>
Fri, 21 Jun 2013 09:53:37 +0000
(10:53 +0100)
ACPI part of the driver accidentally used sizeof(*ssp) instead of the
correct sizeof(*pdata). This leads to nasty memory corruptions like the one
below:
BUG: unable to handle kernel paging request at
0000000749fd30b8
IP: [<
ffffffff813fe8a1
>] __list_del_entry+0x31/0xd0
PGD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 30 Comm: kworker/0:1 Not tainted 3.10.0-rc6v3.10-rc6_sdhci_modprobe+ #443
task:
ffff8801483a0940
ti:
ffff88014839e000
task.ti:
ffff88014839e000
RIP: 0010:[<
ffffffff813fe8a1
>] [<
ffffffff813fe8a1
>] __list_del_entry+0x31/0xd0
RSP: 0000:
ffff88014839fde8
EFLAGS:
00010046
RAX:
ffff880149fd30b0
RBX:
ffff880149fd3040
RCX:
dead000000200200
RDX:
0000000749fd30b0
RSI:
ffff880149fd3058
RDI:
ffff88014834d640
RBP:
ffff88014839fde8
R08:
ffff88014834d640
R09:
0000000000000001
R10:
ffff8801483a0940
R11:
0000000000000001
R12:
ffff880149fd3040
R13:
ffffffff810e0b30
R14:
ffff8801483a0940
R15:
ffff88014834d640
FS:
0000000000000000
(0000) GS:
ffff880149e00000
(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
0000000000000168
CR3:
0000000001e0b000
CR4:
00000000001407f0
DR0:
0000000000000000
DR1:
0000000000000000
DR2:
0000000000000000
DR3:
0000000000000000
DR6:
00000000ffff0ff0
DR7:
0000000000000400
Stack:
ffff88014839fe48
ffffffff810e0baf
ffffffff81120abd
ffff88014839fe20
ffff8801483a0940
ffff8801483a0940
ffff8801483a0940
ffff8801486b1c90
ffff88014834d640
ffffffff810e0b30
0000000000000000
0000000000000000
Call Trace:
[<
ffffffff810e0baf
>] worker_thread+0x7f/0x390
[<
ffffffff81120abd
>] ? trace_hardirqs_on+0xd/0x10
[<
ffffffff810e0b30
>] ? manage_workers.isra.22+0x2b0/0x2b0
[<
ffffffff810e6c09
>] kthread+0xd9/0xe0
[<
ffffffff810f93df
>] ? local_clock+0x3f/0x50
[<
ffffffff810e6b30
>] ? kthread_create_on_node+0x110/0x110
[<
ffffffff818c5dec
>] ret_from_fork+0x7c/0xb0
[<
ffffffff810e6b30
>] ? kthread_create_on_node+0x110/0x110
Fix this by using the right structure size in devm_kzalloc().
Reported-by: Jerome Blin <jerome.blin@intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org # 3.9+
drivers/spi/spi-pxa2xx.c
patch
|
blob
|
history
diff --git
a/drivers/spi/spi-pxa2xx.c
b/drivers/spi/spi-pxa2xx.c
index
f5d84d6
..
48b396f
100644
(file)
--- a/
drivers/spi/spi-pxa2xx.c
+++ b/
drivers/spi/spi-pxa2xx.c
@@
-1075,7
+1075,7
@@
pxa2xx_spi_acpi_get_pdata(struct platform_device *pdev)
acpi_bus_get_device(ACPI_HANDLE(&pdev->dev), &adev))
return NULL;
acpi_bus_get_device(ACPI_HANDLE(&pdev->dev), &adev))
return NULL;
- pdata = devm_kzalloc(&pdev->dev, sizeof(*
ssp
), GFP_KERNEL);
+ pdata = devm_kzalloc(&pdev->dev, sizeof(*
pdata
), GFP_KERNEL);
if (!pdata) {
dev_err(&pdev->dev,
"failed to allocate memory for platform data\n");
if (!pdata) {
dev_err(&pdev->dev,
"failed to allocate memory for platform data\n");