spi: spi-zynqmp-gqspi: Resolved slab-out-of-bounds bug

During a transfer the driver filled the fifo with 4bytes,
even if the data that needs to be transfer is less that 4bytes.
This resulted in slab-out-of-bounds bug in KernelAddressSanitizer.

This patch resolves slab-out-of-bounds bug by filling the fifo
with the number of bytes that needs to transferred.

Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
Link: https://lore.kernel.org/r/20210416004652.2975446-4-quanyang.wang@windriver.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
index 1146359528b9f54fb726e8ce128e62f3b759c169..2e2607b5dee9dc0c0d2028b7f14d4da658c788f8 100644 (file)
--- a/drivers/spi/spi-zynqmp-gqspi.c
+++ b/drivers/spi/spi-zynqmp-gqspi.c
@@ -509,17 +509,19 @@ static void zynqmp_qspi_filltxfifo(struct zynqmp_qspi *xqspi, int size)
        u32 count = 0, intermediate;
 
        while ((xqspi->bytes_to_transfer > 0) && (count < size) && (xqspi->txbuf)) {
-               memcpy(&intermediate, xqspi->txbuf, 4);
-               zynqmp_gqspi_write(xqspi, GQSPI_TXD_OFST, intermediate);
-
                if (xqspi->bytes_to_transfer >= 4) {
+                       memcpy(&intermediate, xqspi->txbuf, 4);
                        xqspi->txbuf += 4;
                        xqspi->bytes_to_transfer -= 4;
+                       count += 4;
                } else {
+                       memcpy(&intermediate, xqspi->txbuf,
+                              xqspi->bytes_to_transfer);
                        xqspi->txbuf += xqspi->bytes_to_transfer;
                        xqspi->bytes_to_transfer = 0;
+                       count += xqspi->bytes_to_transfer;
                }
-               count++;
+               zynqmp_gqspi_write(xqspi, GQSPI_TXD_OFST, intermediate);
        }
 }