spi_mpc83xx: reject invalid transfer sizes

Error out on transfer length != multiple of bytes per word with -EINVAL.
Fixes a buffer overrun crash if length < bytes per word.

Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Acked-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c
index ab7ee445d8b29bdd8f1a1fd3db4ab955d2a3cf72..ac0e3e4b3c543e480028d90829c7f5606b7fde71 100644 (file)
--- a/drivers/spi/spi_mpc83xx.c
+++ b/drivers/spi/spi_mpc83xx.c
@@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
        if (t->bits_per_word)
                bits_per_word = t->bits_per_word;
        len = t->len;
-       if (bits_per_word > 8)
+       if (bits_per_word > 8) {
+               /* invalid length? */
+               if (len & 1)
+                       return -EINVAL;
                len /= 2;
-       if (bits_per_word > 16)
+       }
+       if (bits_per_word > 16) {
+               /* invalid length? */
+               if (len & 1)
+                       return -EINVAL;
                len /= 2;
+       }
        mpc83xx_spi->count = len;
+
        INIT_COMPLETION(mpc83xx_spi->done);
 
        /* enable rx ints */