davidlt/kernel-ark
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
cc0ee9873c
kernel-ark/drivers/spi
History
Mika Westerberg cc0ee9873c spi/pxa2xx: fix memory corruption due to wrong size used in devm_kzalloc() 
ACPI part of the driver accidentally used sizeof(*ssp) instead of the
correct sizeof(*pdata). This leads to nasty memory corruptions like the one
below:

    BUG: unable to handle kernel paging request at 0000000749fd30b8
    IP: [<ffffffff813fe8a1>] __list_del_entry+0x31/0xd0
    PGD 0
    Oops: 0000 [#1] PREEMPT SMP
    Modules linked in:
    CPU: 0 PID: 30 Comm: kworker/0:1 Not tainted 3.10.0-rc6v3.10-rc6_sdhci_modprobe+ #443
    task: ffff8801483a0940 ti: ffff88014839e000 task.ti: ffff88014839e000
    RIP: 0010:[<ffffffff813fe8a1>]  [<ffffffff813fe8a1>] __list_del_entry+0x31/0xd0
    RSP: 0000:ffff88014839fde8  EFLAGS: 00010046
    RAX: ffff880149fd30b0 RBX: ffff880149fd3040 RCX: dead000000200200
    RDX: 0000000749fd30b0 RSI: ffff880149fd3058 RDI: ffff88014834d640
    RBP: ffff88014839fde8 R08: ffff88014834d640 R09: 0000000000000001
    R10: ffff8801483a0940 R11: 0000000000000001 R12: ffff880149fd3040
    R13: ffffffff810e0b30 R14: ffff8801483a0940 R15: ffff88014834d640
    FS:  0000000000000000(0000) GS:ffff880149e00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000168 CR3: 0000000001e0b000 CR4: 00000000001407f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Stack:
     ffff88014839fe48 ffffffff810e0baf ffffffff81120abd ffff88014839fe20
     ffff8801483a0940 ffff8801483a0940 ffff8801483a0940 ffff8801486b1c90
     ffff88014834d640 ffffffff810e0b30 0000000000000000 0000000000000000
    Call Trace:
     [<ffffffff810e0baf>] worker_thread+0x7f/0x390
     [<ffffffff81120abd>] ? trace_hardirqs_on+0xd/0x10
     [<ffffffff810e0b30>] ? manage_workers.isra.22+0x2b0/0x2b0
     [<ffffffff810e6c09>] kthread+0xd9/0xe0
     [<ffffffff810f93df>] ? local_clock+0x3f/0x50
     [<ffffffff810e6b30>] ? kthread_create_on_node+0x110/0x110
     [<ffffffff818c5dec>] ret_from_fork+0x7c/0xb0
     [<ffffffff810e6b30>] ? kthread_create_on_node+0x110/0x110

Fix this by using the right structure size in devm_kzalloc().

Reported-by: Jerome Blin <jerome.blin@intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org # 3.9+
2013-06-21 10:53:37 +01:00
..
Kconfig Removal of GENERIC_GPIO for v3.10 2013-05-09 09:59:16 -07:00
Makefile spi/tegra114: add spi driver 2013-04-07 10:08:00 +01:00
spi-altera.c spi: remove check for bits_per_word on transfer from low level driver 2013-02-05 12:26:59 +00:00
spi-ath79.c spi/ath79: add shutdown handler 2013-02-06 10:41:12 +00:00
spi-atmel.c Merge remote-tracking branch 'spi/fix/grant' into spi-linus 2013-05-13 18:27:18 +04:00
spi-au1550.c spi: Remove erroneous __init, __exit and __exit_p() references in drivers 2013-02-05 14:43:16 +00:00
spi-bcm63xx.c spi/bcm63xx: remove unused speed_hz variable 2013-04-08 13:42:10 +01:00
spi-bcm2835.c spi: bcm2835: make use of new bits_per_word_mask core feature 2013-04-01 14:14:33 +01:00
spi-bfin5xx.c spi: Remove erroneous __init, __exit and __exit_p() references in drivers 2013-02-05 14:43:16 +00:00
spi-bfin-sport.c spi: remove check for bits_per_word on transfer from low level driver 2013-02-05 12:26:59 +00:00
spi-bitbang-txrx.h spi: reorganize drivers 2011-06-06 01:16:30 -06:00
spi-bitbang.c Merge branch 'broonie/spi-next' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/misc.git 2013-02-05 12:30:13 +00:00
spi-butterfly.c spi: Add module.h to implicit users in drivers/spi 2011-10-31 19:32:17 -04:00
spi-clps711x.c spi: remove check for bits_per_word on transfer from low level driver 2013-02-05 12:26:59 +00:00
spi-coldfire-qspi.c spi: remove check for bits_per_word on transfer from low level driver 2013-02-05 12:26:59 +00:00
spi-davinci.c Merge remote-tracking branch 'spi/fix/grant' into spi-linus 2013-05-13 18:27:18 +04:00
spi-dw-mid.c dmaengine/dma_slave: introduce inline wrappers 2012-03-21 19:20:22 +05:30
spi-dw-mmio.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-dw-pci.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-dw.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-dw.h spi: spi-dw: fix all sparse warnings 2011-09-21 09:41:48 -06:00
spi-ep93xx.c Driver core patches for 3.9-rc1 2013-02-21 12:05:51 -08:00
spi-falcon.c spi/mips-lantiq: set SPI_MASTER_HALF_DUPLEX flag 2013-02-05 17:16:55 +00:00
spi-fsl-cpm.c spi/spi-fsl-spi: Make driver usable in CPU mode outside of an FSL_SOC environment 2013-04-07 10:07:54 +01:00
spi-fsl-cpm.h spi/spi-fsl-spi: Make driver usable in CPU mode outside of an FSL_SOC environment 2013-04-07 10:07:54 +01:00
spi-fsl-espi.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-fsl-lib.c spi/spi-fsl-spi: Make driver usable in CPU mode outside of an FSL_SOC environment 2013-04-07 10:07:54 +01:00
spi-fsl-lib.h spi/spi-fsl-spi: Add support for gpio chipselects for GRLIB type cores 2013-04-07 10:07:57 +01:00
spi-fsl-spi.c spi/spi-fsl-spi: Add support for gpio chipselects for GRLIB type cores 2013-04-07 10:07:57 +01:00
spi-fsl-spi.h spi/spi-fsl-spi: Add support for Aeroflex Gaisler GRLIB cores normally running on SPARC 2013-04-07 10:07:56 +01:00
spi-gpio.c spi-gpio: init CS before spi_bitbang_setup() 2013-04-10 14:47:09 +01:00
spi-imx.c spi/imx: Add MODULE_ALIAS() 2013-02-05 13:17:12 +00:00
spi-lm70llp.c spi: By default setup spi_masters with 1 chipselect and dynamics bus number 2012-05-19 23:42:08 -06:00
spi-mpc52xx-psc.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-mpc52xx.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-mpc512x-psc.c spi: spi-mpc512x-psc: let transmiter/receiver enabled when in xfer loop 2013-04-09 17:53:39 +01:00
spi-mxs.c ARM: arm-soc device tree changes, part 2 2013-05-07 11:06:17 -07:00
spi-nuc900.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-oc-tiny.c spi: spi-oc-tiny: Use of_match_ptr() macro 2013-04-01 14:27:09 +01:00
spi-octeon.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-omap2-mcspi.c spi: omap2-mcspi: fix error return code in omap2_mcspi_probe() 2013-04-18 12:04:55 +01:00
spi-omap-100k.c spi: Remove erroneous __init, __exit and __exit_p() references in drivers 2013-02-05 14:43:16 +00:00
spi-omap-uwire.c spi: Remove erroneous __init, __exit and __exit_p() references in drivers 2013-02-05 14:43:16 +00:00
spi-orion.c spi/orion: Use module_platform_driver() 2013-02-05 14:44:14 +00:00
spi-pl022.c spi: pl022: use generic DMA slave configuration if possible 2013-03-12 17:56:08 +01:00
spi-ppc4xx.c Device tree changes for v3.9 2013-02-20 11:04:46 -08:00
spi-pxa2xx-dma.c spi/pxa2xx: use GFP_ATOMIC in sg table allocation 2013-06-18 19:11:04 +01:00
spi-pxa2xx-pci.c spi/pxa2xx-pci: correct the return value check of pcim_iomap_regions() 2013-03-12 18:30:56 +00:00
spi-pxa2xx-pxadma.c spi/pxa2xx: break out the private DMA API usage into a separate file 2013-02-08 12:15:21 +00:00
spi-pxa2xx.c spi/pxa2xx: fix memory corruption due to wrong size used in devm_kzalloc() 2013-06-21 10:53:37 +01:00
spi-pxa2xx.h spi/pxa2xx: add support for Intel Low Power Subsystem SPI 2013-02-08 13:14:40 +00:00
spi-rspi.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-s3c24xx-fiq.h spi: reorganize drivers 2011-06-06 01:16:30 -06:00
spi-s3c24xx-fiq.S spi: reorganize drivers 2011-06-06 01:16:30 -06:00
spi-s3c24xx.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-s3c64xx.c spi/s3c64xx: Check for errors in dmaengine prepare_transfer() 2013-04-18 18:17:27 +01:00
spi-sc18is602.c spi/sc18is602: Return -EINVAL for probe failures due to I2C function mismatch 2012-08-23 12:13:54 +01:00
spi-sh-hspi.c spi: hspi: fixup long delay time 2013-06-04 18:51:40 +01:00
spi-sh-msiof.c spi: spi-sh-msiof: Use of_match_ptr() macro 2013-04-01 14:27:14 +01:00
spi-sh-sci.c spi: Add module.h to implicit users in drivers/spi 2011-10-31 19:32:17 -04:00
spi-sh.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-sirf.c spi/sirf: fix MODULE_DEVICE_TABLE 2013-04-23 19:27:00 +01:00
spi-tegra20-sflash.c drivers/spi: don't check resource with devm_ioremap_resource 2013-05-18 11:57:24 +02:00
spi-tegra20-slink.c spi: tegra: slink: make local symbols static 2013-04-08 13:41:34 +01:00
spi-tegra114.c spi/tegra114: add spi driver 2013-04-07 10:08:00 +01:00
spi-ti-ssp.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-tle62x0.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-topcliff-pch.c spi: topcliff-pch: fix error return code in pch_spi_probe() 2013-05-22 11:08:36 -05:00
spi-txx9.c spi: Remove erroneous __init, __exit and __exit_p() references in drivers 2013-02-05 14:43:16 +00:00
spi-xcomm.c spi: Remove HOTPLUG section attributes 2012-12-07 17:06:43 +00:00
spi-xilinx.c spi: spi-xilinx: Remove ISR race condition 2013-06-04 18:32:19 +01:00
spi.c Merge remote-tracking branch 'spi/fix/grant' into spi-linus 2013-05-13 18:27:18 +04:00
spidev.c spi/spidev: Use PTR_RET function 2013-04-01 14:32:32 +01:00