| From 2444d55d44b85994b6bb28daddb21feefdb22f2a Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 16 Apr 2021 08:46:51 +0800 |
| Subject: spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op |
| |
| From: Quanyang Wang <quanyang.wang@windriver.com> |
| |
| [ Upstream commit a2c5bedb2d55dd27c642c7b9fb6886d7ad7bdb58 ] |
| |
| When handling op->addr, it is using the buffer "tmpbuf" which has been |
| freed. This will trigger a use-after-free KASAN warning. Let's use |
| temporary variables to store op->addr.val and op->cmd.opcode to fix |
| this issue. |
| |
| Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") |
| Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com> |
| Link: https://lore.kernel.org/r/20210416004652.2975446-5-quanyang.wang@windriver.com |
| Signed-off-by: Mark Brown <broonie@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/spi/spi-zynqmp-gqspi.c | 14 ++++---------- |
| 1 file changed, 4 insertions(+), 10 deletions(-) |
| |
| diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c |
| index d6ac8fe145a1..2a0be16b2eb0 100644 |
| --- a/drivers/spi/spi-zynqmp-gqspi.c |
| +++ b/drivers/spi/spi-zynqmp-gqspi.c |
| @@ -926,8 +926,9 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, |
| struct zynqmp_qspi *xqspi = spi_controller_get_devdata |
| (mem->spi->master); |
| int err = 0, i; |
| - u8 *tmpbuf; |
| u32 genfifoentry = 0; |
| + u16 opcode = op->cmd.opcode; |
| + u64 opaddr; |
| |
| dev_dbg(xqspi->dev, "cmd:%#x mode:%d.%d.%d.%d\n", |
| op->cmd.opcode, op->cmd.buswidth, op->addr.buswidth, |
| @@ -940,14 +941,8 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, |
| genfifoentry |= xqspi->genfifobus; |
| |
| if (op->cmd.opcode) { |
| - tmpbuf = kzalloc(op->cmd.nbytes, GFP_KERNEL | GFP_DMA); |
| - if (!tmpbuf) { |
| - mutex_unlock(&xqspi->op_lock); |
| - return -ENOMEM; |
| - } |
| - tmpbuf[0] = op->cmd.opcode; |
| reinit_completion(&xqspi->data_completion); |
| - xqspi->txbuf = tmpbuf; |
| + xqspi->txbuf = &opcode; |
| xqspi->rxbuf = NULL; |
| xqspi->bytes_to_transfer = op->cmd.nbytes; |
| xqspi->bytes_to_receive = 0; |
| @@ -961,13 +956,12 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, |
| if (!wait_for_completion_timeout |
| (&xqspi->data_completion, msecs_to_jiffies(1000))) { |
| err = -ETIMEDOUT; |
| - kfree(tmpbuf); |
| goto return_err; |
| } |
| - kfree(tmpbuf); |
| } |
| |
| if (op->addr.nbytes) { |
| + xqspi->txbuf = &opaddr; |
| for (i = 0; i < op->addr.nbytes; i++) { |
| *(((u8 *)xqspi->txbuf) + i) = op->addr.val >> |
| (8 * (op->addr.nbytes - i - 1)); |
| -- |
| 2.30.2 |
| |