| From aa695f54c79bb72710fce2a1c8dbd657afb8334d Mon Sep 17 00:00:00 2001 |
| From: DongCV <cv-dong@jinso.co.jp> |
| Date: Wed, 15 Feb 2017 19:50:51 +0900 |
| Subject: [PATCH 121/255] spi: rspi: Fixes bogus received byte in |
| qspi_transfer_in() |
| |
| In qspi_transfer_in(), when receiving the last n (or len) bytes of data, |
| one bogus byte was written in the receive buffer. |
| This code leads to a buffer overflow. |
| |
| "jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found |
| at 0x03b40000: 0x1900 instead |
| jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found |
| at 0x03b40004: 0x000c instead" |
| |
| The error message above happens when trying to mount, unmount, |
| and remount a jffs2-formatted device. |
| This patch removed the bogus write to fixes: 3be09bec42a800d4 |
| "spi: rspi: supports 32bytes buffer for DUAL and QUAD" |
| |
| And here is Geert's comment: |
| |
| "spi: rspi: Fix bogus received byte in qspi_transfer_in() |
| When there are less than QSPI_BUFFER_SIZE remaining bytes to be received, |
| qspi_transfer_in() writes one bogus byte in the receive buffer, possibly |
| leading to a buffer overflow. |
| This can be reproduced by mounting, unmounting, and remounting a |
| jffs2-formatted device, causing lots of warnings like: |
| |
| "jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found |
| at 0x03b40000: 0x1900 instead" |
| |
| Remove the bogus write to fix this. " |
| |
| Signed-off-by: DongCV <cv-dong@jinso.co.jp> |
| Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> |
| Signed-off-by: Mark Brown <broonie@kernel.org> |
| (cherry picked from commit 7264abc7000d601726aefb05189ea524ee3995ba) |
| Signed-off-by: Simon Horman <horms+renesas@verge.net.au> |
| --- |
| drivers/spi/spi-rspi.c | 1 - |
| 1 file changed, 1 deletion(-) |
| |
| --- a/drivers/spi/spi-rspi.c |
| +++ b/drivers/spi/spi-rspi.c |
| @@ -848,7 +848,6 @@ static int qspi_transfer_in(struct rspi_ |
| ret = rspi_pio_transfer(rspi, NULL, rx, n); |
| if (ret < 0) |
| return ret; |
| - *rx++ = ret; |
| } |
| n -= len; |
| } |