From aa77d96ba94326db4f50d2aa36602824dd03286a Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Sat, 13 Sep 2008 02:33:15 -0700 Subject: [PATCH] spi_mpc83xx: reject invalid transfer sizes Error out on transfer length != multiple of bytes per word with -EINVAL. Fixes a buffer overrun crash if length < bytes per word. Signed-off-by: Peter Korsgaard Acked-by: Joakim Tjernlund Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/spi/spi_mpc83xx.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c index ab7ee44..ac0e3e4 100644 --- a/drivers/spi/spi_mpc83xx.c +++ b/drivers/spi/spi_mpc83xx.c @@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_device *spi, struct spi_transfer *t) if (t->bits_per_word) bits_per_word = t->bits_per_word; len = t->len; - if (bits_per_word > 8) + if (bits_per_word > 8) { + /* invalid length? */ + if (len & 1) + return -EINVAL; len /= 2; - if (bits_per_word > 16) + } + if (bits_per_word > 16) { + /* invalid length? */ + if (len & 1) + return -EINVAL; len /= 2; + } mpc83xx_spi->count = len; + INIT_COMPLETION(mpc83xx_spi->done); /* enable rx ints */ -- 2.7.4