]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob - queue-4.4/spi-fix-zero-length-xfer-bug.patch
drop rdma-cma-consider-scope_id-while-binding-to-ipv6-ll-.patch from 4.4, 4.9, and...
[thirdparty/kernel/stable-queue.git] / queue-4.4 / spi-fix-zero-length-xfer-bug.patch
1 From 10de7ce50a7f99f93255fb576dc49fd914ae33ec Mon Sep 17 00:00:00 2001
2 From: Chris Lesiak <chris.lesiak@licor.com>
3 Date: Thu, 7 Mar 2019 20:39:00 +0000
4 Subject: spi: Fix zero length xfer bug
5
6 [ Upstream commit 5442dcaa0d90fc376bdfc179a018931a8f43dea4 ]
7
8 This fixes a bug for messages containing both zero length and
9 unidirectional xfers.
10
11 The function spi_map_msg will allocate dummy tx and/or rx buffers
12 for use with unidirectional transfers when the hardware can only do
13 a bidirectional transfer. That dummy buffer will be used in place
14 of a NULL buffer even when the xfer length is 0.
15
16 Then in the function __spi_map_msg, if he hardware can dma,
17 the zero length xfer will have spi_map_buf called on the dummy
18 buffer.
19
20 Eventually, __sg_alloc_table is called and returns -EINVAL
21 because nents == 0.
22
23 This fix prevents the error by not using the dummy buffer when
24 the xfer length is zero.
25
26 Signed-off-by: Chris Lesiak <chris.lesiak@licor.com>
27 Signed-off-by: Mark Brown <broonie@kernel.org>
28 Signed-off-by: Sasha Levin <sashal@kernel.org>
29 ---
30 drivers/spi/spi.c | 2 ++
31 1 file changed, 2 insertions(+)
32
33 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
34 index 04fd651f9e3e3..c132c676df3a6 100644
35 --- a/drivers/spi/spi.c
36 +++ b/drivers/spi/spi.c
37 @@ -903,6 +903,8 @@ static int spi_map_msg(struct spi_master *master, struct spi_message *msg)
38 if (max_tx || max_rx) {
39 list_for_each_entry(xfer, &msg->transfers,
40 transfer_list) {
41 + if (!xfer->len)
42 + continue;
43 if (!xfer->tx_buf)
44 xfer->tx_buf = master->dummy_tx;
45 if (!xfer->rx_buf)
46 --
47 2.20.1
48