Skip to content

Commit 8e9204c

Browse files
mszyprowbroonie
authored andcommitted
spi: Ensure that sg_table won't be used after being freed
SPI code checks for non-zero sgt->orig_nents to determine if the buffer has been DMA-mapped. Ensure that sg_table is really zeroed after free to avoid potential NULL pointer dereference if the given SPI xfer object is reused again without being DMA-mapped. Fixes: 0c17ba7 ("spi: Fix cache corruption due to DMA/PIO overlap") Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Link: https://lore.kernel.org/r/20220930113408.19720-1-m.szyprowski@samsung.com Signed-off-by: Mark Brown <broonie@kernel.org>
1 parent 28366dd commit 8e9204c

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

drivers/spi/spi.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1102,6 +1102,8 @@ static void spi_unmap_buf_attrs(struct spi_controller *ctlr,
11021102
if (sgt->orig_nents) {
11031103
dma_unmap_sgtable(dev, sgt, dir, attrs);
11041104
sg_free_table(sgt);
1105+
sgt->orig_nents = 0;
1106+
sgt->nents = 0;
11051107
}
11061108
}
11071109

0 commit comments

Comments
 (0)