[EXT] [PATCH] spi: spi-imx: Add check for spi_imx_setupxfer()

[Carlos Song]

Hi, Thank you for fix.

Reviewed-by: Carlos Song <carlos.song at nxp.com>

> -----Original Message-----
> From: Tamura Dai <kirinode0 at gmail.com>
> Sent: Thursday, April 17, 2025 9:16 AM
> To: Mark Brown <broonie at kernel.org>; Shawn Guo <shawnguo at kernel.org>;
> Sascha Hauer <s.hauer at pengutronix.de>; Pengutronix Kernel Team
> <kernel at pengutronix.de>; Fabio Estevam <festevam at gmail.com>
> Cc: linux-spi at vger.kernel.org; imx at lists.linux.dev;
> linux-arm-kernel at lists.infradead.org; linux-kernel at vger.kernel.org; Tamura Dai
> <kirinode0 at gmail.com>
> Subject: [EXT] [PATCH] spi: spi-imx: Add check for spi_imx_setupxfer()
> 
> [You don't often get email from kirinode0 at gmail.com. Learn why this is
> important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> Caution: This is an external email. Please take care when clicking links or
> opening attachments. When in doubt, report the message using the 'Report
> this email' button
> 
> 
> Add check for the return value of spi_imx_setupxfer().
> spi_imx->rx and spi_imx->tx function pointer can be NULL when
> spi_imx_setupxfer() return error, and make NULL pointer dereference.
> 
>  Unable to handle kernel NULL pointer dereference at virtual address
> 0000000000000000  Call trace:
>   0x0
>   spi_imx_pio_transfer+0x50/0xd8
>   spi_imx_transfer_one+0x18c/0x858
>   spi_transfer_one_message+0x43c/0x790
>   __spi_pump_transfer_message+0x238/0x5d4
>   __spi_sync+0x2b0/0x454
>   spi_write_then_read+0x11c/0x200
> 
> Signed-off-by: Tamura Dai <kirinode0 at gmail.com>
> ---
>  drivers/spi/spi-imx.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c index
> 832d6e9009eb..c93d80a4d734 100644
> --- a/drivers/spi/spi-imx.c
> +++ b/drivers/spi/spi-imx.c
> @@ -1695,9 +1695,12 @@ static int spi_imx_transfer_one(struct
> spi_controller *controller,
>                                 struct spi_device *spi,
>                                 struct spi_transfer *transfer)  {
> +       int ret;
>         struct spi_imx_data *spi_imx =
> spi_controller_get_devdata(spi->controller);
> 
> -       spi_imx_setupxfer(spi, transfer);
> +       ret = spi_imx_setupxfer(spi, transfer);
> +       if (ret < 0)
> +               return ret;
>         transfer->effective_speed_hz = spi_imx->spi_bus_clk;
> 
>         /* flush rxfifo before transfer */
> --
> 2.47.2
>