target/linux/generic/pending-5.4/132-spi-spi-gpio-fix-crash-when-num-chipselects-is-0.patch

   1 From 0f76408d8c1cb0979f4286dd23912e6e59784b35 Mon Sep 17 00:00:00 2001
   2 From: DENG Qingfang <dqfext@gmail.com>
   3 Date: Thu, 19 Sep 2019 11:42:55 +0200
   4 Subject: [PATCH] spi: spi-gpio: fix crash when num-chipselects is 0
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 If an spi-gpio was specified with num-chipselects = <0> in dts, kernel will crash:
  10
  11 Unable to handle kernel paging request at virtual address 32697073
  12 pgd = (ptrval)
  13 [32697073] *pgd=00000000
  14 Internal error: Oops: 5 [# 1] SMP ARM
  15 Modules linked in:
  16 CPU: 2 PID: 1 Comm: swapper/0 Not tainted 4.19.72 #0
  17 Hardware name: Generic DT based system
  18 PC is at validate_desc+0x28/0x80
  19 LR is at gpiod_direction_output+0x14/0x128
  20 ...
  21 [<c0544db4>] (validate_desc) from [<c0545228>] (gpiod_direction_output+0x14/0x128)
  22 [<c0545228>] (gpiod_direction_output) from [<c05fa714>] (spi_gpio_setup+0x58/0x64)
  23 [<c05fa714>] (spi_gpio_setup) from [<c05f7258>] (spi_setup+0x12c/0x148)
  24 [<c05f7258>] (spi_setup) from [<c05f7330>] (spi_add_device+0xbc/0x12c)
  25 [<c05f7330>] (spi_add_device) from [<c05f7f74>] (spi_register_controller+0x838/0x924)
  26 [<c05f7f74>] (spi_register_controller) from [<c05fa494>] (spi_bitbang_start+0x108/0x120)
  27 [<c05fa494>] (spi_bitbang_start) from [<c05faa34>] (spi_gpio_probe+0x314/0x338)
  28 [<c05faa34>] (spi_gpio_probe) from [<c05a844c>] (platform_drv_probe+0x34/0x70)
  29
  30 The cause is spi_gpio_setup() did not check if the spi-gpio has chipselect pins
  31 before setting their direction and results in derefing an invalid pointer.
  32
  33 The bug is spotted in kernel 4.19.72 on OpenWrt, and does not occur in 4.14.
  34
  35 There is a similar fix upstream 249e2632dcd0509b8f8f296f5aabf4d48dfd6da8.
  36
  37 Ref: https://patchwork.kernel.org/patch/11150619/
  38 Cc: Linus Walleij <linus.walleij@linaro.org>
  39 Cc: stable@vger.kernel.org
  40 Signed-off-by: DENG Qingfang <dqfext@gmail.com>
  41 Signed-off-by: Petr Štetiar <ynezz@true.cz>
  42 ---
  43  drivers/spi/spi-gpio.c | 10 ++++++----
  44  1 file changed, 6 insertions(+), 4 deletions(-)
  45
  46 --- a/drivers/spi/spi-gpio.c
  47 +++ b/drivers/spi/spi-gpio.c
  48 @@ -242,10 +242,12 @@ static int spi_gpio_setup(struct spi_dev
  49          * The CS GPIOs have already been
  50          * initialized from the descriptor lookup.
  51          */
  52 -       cs = spi_gpio->cs_gpios[spi->chip_select];
  53 -       if (!spi->controller_state && cs)
  54 -               status = gpiod_direction_output(cs,
  55 -                                               !(spi->mode & SPI_CS_HIGH));
  56 +       if (spi_gpio->has_cs) {
  57 +               cs = spi_gpio->cs_gpios[spi->chip_select];
  58 +               if (!spi->controller_state && cs)
  59 +                       status = gpiod_direction_output(cs,
  60 +                                                 !(spi->mode & SPI_CS_HIGH));
  61 +       }
  62
  63         if (!status)
  64                 status = spi_bitbang_setup(spi);