| commit | de327e4966cdbad2b7053c84a6f591fbdc54f7cb | [log] [tgz] |
|---|---|---|
| author | Nicolas Boichat <drinkcat@chromium.org> | Sun Dec 27 18:17:06 2015 +0800 |
| committer | Mark Brown <broonie@kernel.org> | Wed Dec 30 17:26:40 2015 +0000 |
| tree | 4d84876c8a528509fa6c9fa412a401934f80f56d | |
| parent | 8005c49d9aea74d382f474ce11afbbc7d7130bec [diff] |
spi: mediatek: Prevent overflows in FIFO transfers In the case where transfer length is not a multiple of 4, KASAN reports 2 out-of-bounds memory accesses: - mtk_spi_interrupt: ioread32_rep writes past the end of trans->rx_buf. - mtk_spi_fifo_transfer: iowrite32_rep reads past the end of xfer->tx_buf. Fix this by using memcpy on the remainder of the bytes. Signed-off-by: Nicolas Boichat <drinkcat@chromium.org> Signed-off-by: Mark Brown <broonie@kernel.org>