spi: bcm2835aux: remove dangerous uncontrolled read of fifo [Linux 4.19.72]

This Linux kernel change "spi: bcm2835aux: remove dangerous uncontrolled read of fifo" is included in the Linux 4.19.72 release. This change is authored by Martin Sperl <kernel [at] martin.sperl.org> on Sat Mar 30 09:30:59 2019 +0000. The commit for this change in Linux stable tree is fe49c3d (patch) which is from upstream commit c7de850. The same Linux upstream change may have been applied to various maintained Linux releases and you can find all Linux releases containing changes from upstream c7de850.

spi: bcm2835aux: remove dangerous uncontrolled read of fifo

[ Upstream commit c7de8500fd8ecbb544846dd5f11dca578c3777e1 ]

This read of the fifo is a potential candidate for a race condition
as the spi transfer is not necessarily finished and so can lead to
an early read of the fifo that still misses data.

So it has been removed.

Fixes: 1ea29b39f4c812ec ("spi: bcm2835aux: add bcm2835 auxiliary spi device...")
Suggested-by: Hubert Denkmair <h.denkmair@intence.de>
Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

There are 7 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/spi/spi-bcm2835aux.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 79306e6..b4217f9 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -194,13 +194,6 @@ static void bcm2835aux_spi_transfer_helper(struct bcm2835aux_spi *bs)
          BCM2835_AUX_SPI_STAT_TX_FULL))) {
        bcm2835aux_wr_fifo(bs);
    }
-
-   /* and check if we have reached "done" */
-   while (bs->rx_len &&
-          (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) &
-         BCM2835_AUX_SPI_STAT_BUSY))) {
-       bcm2835aux_rd_fifo(bs);
-   }
 }

 static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)

Leave a Reply

Your email address will not be published. Required fields are marked *