[PATCH 0/3] spi: imx: Three fixes for the i.MX SPI driver

[John Madieu]

Hi All,

This series independent fixes found in the i.MX SPI driver.

These are:

1/3 fixes a precedence bug in spi_imx_dma_max_wml_find() that makes
    the watermark-finding logic effectively dead code. The function
    currently always returns wml = 1 because of how the !-operator
    binds to the modulo expression.

2/3 fixes a missing return on the package-1 failure path in
    spi_imx_dma_data_prepare(). The error path frees the
    dma_data array and the package-0 buffers, then falls through
    to "return 0" - the caller proceeds with a freed pointer.

3/3 makes spi_imx_setupxfer() propagate the prepare_transfer()
    return value. Currently a -EINVAL from mx51_ecspi_prepare_transfer
    (e.g. on a word_delay overflow) is silently swallowed and the
    transfer proceeds with a partially-configured controller.

Regards,

John Madieu (3):
  spi: imx: Fix precedence bug in spi_imx_dma_max_wml_find()
  spi: imx: Fix UAF on package-1 prepare failure in
    spi_imx_dma_data_prepare()
  spi: imx: Propagate prepare_transfer() error from spi_imx_setupxfer()

 drivers/spi/spi-imx.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

-- 
2.25.1