From 53604dbe1371c3c4458c2d741adbd8cfd8fe8e79 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Sat, 13 Sep 2008 02:33:14 -0700 Subject: spi_mpc83xx: fix clockrate calculation for low speed Commit a61f5345 (spi_mpc83xx clockrate fixes) broke clockrate calculation for low speeds. SPMODE_DIV16 should be set if the divider is higher than 64, not only if the divider gets clipped to 1024. Furthermore, the clipping check was off by a factor 16 as well. Signed-off-by: Peter Korsgaard Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/spi/spi_mpc83xx.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) (limited to 'drivers/spi/spi_mpc83xx.c') diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c index 070c6219e2d..ab7ee445d8b 100644 --- a/drivers/spi/spi_mpc83xx.c +++ b/drivers/spi/spi_mpc83xx.c @@ -267,16 +267,13 @@ int mpc83xx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t) cs->hw_mode |= SPMODE_LEN(bits_per_word); if ((mpc83xx_spi->spibrg / hz) > 64) { + cs->hw_mode |= SPMODE_DIV16; pm = mpc83xx_spi->spibrg / (hz * 64); if (pm > 16) { - cs->hw_mode |= SPMODE_DIV16; - pm /= 16; - if (pm > 16) { - dev_err(&spi->dev, "Requested speed is too " - "low: %d Hz. Will use %d Hz instead.\n", - hz, mpc83xx_spi->spibrg / 1024); - pm = 16; - } + dev_err(&spi->dev, "Requested speed is too " + "low: %d Hz. Will use %d Hz instead.\n", + hz, mpc83xx_spi->spibrg / 1024); + pm = 16; } } else pm = mpc83xx_spi->spibrg / (hz * 4); -- cgit v1.2.3 From aa77d96ba94326db4f50d2aa36602824dd03286a Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Sat, 13 Sep 2008 02:33:15 -0700 Subject: spi_mpc83xx: reject invalid transfer sizes Error out on transfer length != multiple of bytes per word with -EINVAL. Fixes a buffer overrun crash if length < bytes per word. Signed-off-by: Peter Korsgaard Acked-by: Joakim Tjernlund Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/spi/spi_mpc83xx.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) (limited to 'drivers/spi/spi_mpc83xx.c') diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c index ab7ee445d8b..ac0e3e4b3c5 100644 --- a/drivers/spi/spi_mpc83xx.c +++ b/drivers/spi/spi_mpc83xx.c @@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_device *spi, struct spi_transfer *t) if (t->bits_per_word) bits_per_word = t->bits_per_word; len = t->len; - if (bits_per_word > 8) + if (bits_per_word > 8) { + /* invalid length? */ + if (len & 1) + return -EINVAL; len /= 2; - if (bits_per_word > 16) + } + if (bits_per_word > 16) { + /* invalid length? */ + if (len & 1) + return -EINVAL; len /= 2; + } mpc83xx_spi->count = len; + INIT_COMPLETION(mpc83xx_spi->done); /* enable rx ints */ -- cgit v1.2.3