Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 24 Jun 2021 12:44:31 +0100
From:   Mark Brown <broonie@kernel.org>
To:     lijian_8010a29@163.com
Cc:     linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org,
        lijian <lijian@yulong.com>
Subject: Re: [PATCH] spi: spi-topcliff-pch: Fixed the possible null pointer
 exception issue
Message-ID: <20210624114430.GB3912@sirena.org.uk>
References: <20210624105056.167233-1-lijian_8010a29@163.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="z6Eq5LdranGa6ru8"
Content-Disposition: inline
In-Reply-To: <20210624105056.167233-1-lijian_8010a29@163.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Precedence: bulk


--z6Eq5LdranGa6ru8
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Jun 24, 2021 at 06:50:56PM +0800, lijian_8010a29@163.com wrote:
> From: lijian <lijian@yulong.com>
>=20
> The 'data->pkt_tx_buff' is used after called
> =E2=80=98kfree(data->pkt_tx_buff)=E2=80=99,it may be null when it is call=
ed,
> and null pointer exception may occur,
> so judgment is added when using 'data->pkt_tx_buff'.

> -	if (data->cur_trans->tx_buf !=3D NULL) {
> +	if ((data->cur_trans->tx_buf !=3D NULL) && (data->pkt_tx_buff !=3D NULL=
)) {
>  		if (*bpw =3D=3D 8) {
>  			tx_buf =3D data->cur_trans->tx_buf;
>  			for (j =3D 0; j < data->bpw_len; j++)
> @@ -621,8 +621,10 @@ static void pch_spi_set_tx(struct pch_spi_data *data=
, int *bpw)
>  		__func__);
>  	pch_spi_writereg(data->master, PCH_SSNXCR, SSN_LOW);
> =20
> -	for (j =3D 0; j < n_writes; j++)
> -		pch_spi_writereg(data->master, PCH_SPDWR, data->pkt_tx_buff[j]);
> +	if (data->pkt_tx_buff !=3D NULL) {
> +		for (j =3D 0; j < n_writes; j++)

I've not checked to make sure that the dereference can happen but if it
does and these checks prevent dereferences it seems that they do so by
simply skipping the writes that were happening which will result in the
driver just silently dropping data, probably creating serious problems
for whatever SPI device is attached.  We should ideally carry on with
the transmit, or at the very least return an error if things fail.

--z6Eq5LdranGa6ru8
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmDUcB4ACgkQJNaLcl1U
h9BKBwf8Cbf2h7wD7pP0qwku78wjJrZXdhvRVLqCX5SUPv6gZqKBJJSrd5ZoABPS
TDSuXhf6FOhYQclnv1tt2YmiYZehAxVh613gUzOoXB/vYqyteY2wsvEzV/Fgo+E6
hFSjGDpixzO86/pzC3HQo6HTo1S9mPTkXHPfXDqjB/QnR5oWn5jyJm4ZKhz02PXT
z39Eg4N3IBgAXhaiRa3tVAtewboIuswFfG7j/Z/4keMQm2A7uh7oxacjG+jgDyd9
dtmNrnGsSCrxzYT8x2psZgfi6qt2tb4VeDKUt5pXhHinmHPNQcd2IVTB/nycmY8w
MzcVsDmrZmGmpjh9IWlusuvMUwBWew==
=u7Ze
-----END PGP SIGNATURE-----

--z6Eq5LdranGa6ru8--