spi: mediatek: Prevent overflows in FIFO transfers
authorNicolas Boichat <drinkcat@chromium.org>
Sun, 27 Dec 2015 10:17:06 +0000 (18:17 +0800)
committerMark Brown <broonie@kernel.org>
Wed, 30 Dec 2015 17:26:40 +0000 (17:26 +0000)
commitde327e4966cdbad2b7053c84a6f591fbdc54f7cb
tree4d84876c8a528509fa6c9fa412a401934f80f56d
parent8005c49d9aea74d382f474ce11afbbc7d7130bec
spi: mediatek: Prevent overflows in FIFO transfers

In the case where transfer length is not a multiple of 4, KASAN
reports 2 out-of-bounds memory accesses:
 - mtk_spi_interrupt: ioread32_rep writes past the end of
   trans->rx_buf.
 - mtk_spi_fifo_transfer: iowrite32_rep reads past the end of
   xfer->tx_buf.

Fix this by using memcpy on the remainder of the bytes.

Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
drivers/spi/spi-mt65xx.c