summaryrefslogtreecommitdiff
path: root/drivers/spi
diff options
context:
space:
mode:
authorJuan Gutierrez <juan.gutierrez@nxp.com>2016-11-21 16:50:03 -0600
committerMark Brown <broonie@kernel.org>2016-11-22 16:27:31 +0000
commit8dd4a0163e7315d196e54780591b7426fa78e1fa (patch)
tree4ada86f84112b4644e5710d69033325db75ab356 /drivers/spi
parent1001354ca34179f3db924eb66672442a173147dc (diff)
spi: use sg_next for walking through the allocated scatterlist table
A null dereference or Oops exception might occurs when reading at once the whole content of an spi-nor of big enough size that requires an scatterlist table that does not fit into one single page. The spi_map_buf function is ignoring the chained sg case by dereferenceing the scatterlist elements in an array fashion. This wrongly assumes that the allocation of the scatterlist elements are contiguous. This is true as long as the scatterlist table fits within a PAGE_SIZE. However, for allocation where the scatter table is bigger than that, the pages allocated by sg_alloc might not be contigous. The sg table can be properly walked by sg_next instead of using an array. Signed-off-by: Juan Gutierrez <juan.gutierrez@nxp.com> Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'drivers/spi')
-rw-r--r--drivers/spi/spi.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 5787b723b593..2cfe67f73476 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -720,6 +720,7 @@ static int spi_map_buf(struct spi_master *master, struct device *dev,
int desc_len;
int sgs;
struct page *vm_page;
+ struct scatterlist *sg;
void *sg_buf;
size_t min;
int i, ret;
@@ -738,6 +739,7 @@ static int spi_map_buf(struct spi_master *master, struct device *dev,
if (ret != 0)
return ret;
+ sg = &sgt->sgl[0];
for (i = 0; i < sgs; i++) {
if (vmalloced_buf || kmap_buf) {
@@ -751,16 +753,17 @@ static int spi_map_buf(struct spi_master *master, struct device *dev,
sg_free_table(sgt);
return -ENOMEM;
}
- sg_set_page(&sgt->sgl[i], vm_page,
+ sg_set_page(sg, vm_page,
min, offset_in_page(buf));
} else {
min = min_t(size_t, len, desc_len);
sg_buf = buf;
- sg_set_buf(&sgt->sgl[i], sg_buf, min);
+ sg_set_buf(sg, sg_buf, min);
}
buf += min;
len -= min;
+ sg = sg_next(sg);
}
ret = dma_map_sg(dev, sgt->sgl, sgt->nents, dir);