diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2022-01-25 09:52:02 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2022-02-08 13:40:16 +0000 |
| commit | 833026ad56f76d1a1035d6511fd5aeed308465fd (patch) | |
| tree | f8b134ab79eb7f53f6c434d5a0cd4ec153f5f43f /drivers/spi/spidev.c | |
| parent | 4e28b22225e3a8b7f1bd3e093301802a2238071a (diff) | |
spi: spidev: prevent spidev->speed_hz from being zero
A zero value for spi->max_speed_hz or spidev->speed_hz does not make
sense and trying to set that can lead to divide by zero crashes in
a some of the drivers.
drivers/spi/spi-s3c64xx.c:874 s3c64xx_spi_setup() error: potential divide by zero bug '/ spi->max_speed_hz'.
drivers/spi/spi-fsl-dspi.c:613 hz_to_spi_baud() error: potential divide by zero bug '/ speed_hz'.
drivers/spi/spi-xlp.c:146 xlp_spi_setup() error: potential divide by zero bug '/ (spi->max_speed_hz)'.
drivers/spi/spi-orion.c:162 orion_spi_baudrate_set() error: potential divide by zero bug '/ speed'.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20220125065202.GA8807@kili
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'drivers/spi/spidev.c')
| -rw-r--r-- | drivers/spi/spidev.c | 31 |
1 files changed, 19 insertions, 12 deletions
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c index a5cceca8b82b..dd824db63fbe 100644 --- a/drivers/spi/spidev.c +++ b/drivers/spi/spidev.c @@ -453,22 +453,29 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) dev_dbg(&spi->dev, "%d bits per word\n", tmp); } break; - case SPI_IOC_WR_MAX_SPEED_HZ: + case SPI_IOC_WR_MAX_SPEED_HZ: { + u32 save; + retval = get_user(tmp, (__u32 __user *)arg); - if (retval == 0) { - u32 save = spi->max_speed_hz; + if (retval) + break; + if (tmp == 0) { + retval = -EINVAL; + break; + } - spi->max_speed_hz = tmp; - retval = spi_setup(spi); - if (retval == 0) { - spidev->speed_hz = tmp; - dev_dbg(&spi->dev, "%d Hz (max)\n", - spidev->speed_hz); - } - spi->max_speed_hz = save; + save = spi->max_speed_hz; + + spi->max_speed_hz = tmp; + retval = spi_setup(spi); + if (retval == 0) { + spidev->speed_hz = tmp; + dev_dbg(&spi->dev, "%d Hz (max)\n", spidev->speed_hz); } - break; + spi->max_speed_hz = save; + break; + } default: /* segmented and/or full-duplex I/O request */ /* Check message and copy into scratch area */ |