Re: [PATCH v2] spi: pic32-sqi: guard against empty BD list in pic32_sqi_one_message()

[Mark Brown]

> list_first_entry()/list_last_entry() do not return NULL on an empty
> list; they return the container_of() of the list head, i.e. a wild
> pointer.
> 
> The SPI core rejects a message with no transfers, but it accepts a
> transfer that has neither tx_buf nor rx_buf. For such transfers
> pic32_sqi_one_transfer() iterates an empty scatterlist, queues no
> buffer descriptor and still returns success, so a message made up only
> of buffer-less transfers leaves sqi->bd_list_used empty. The subsequent
> list_last_entry() then returns a wild pointer through which the driver
> sets BD_LAST/BD_CS_DEASSERT, and list_first_entry() returns another one
> whose bd_dma is programmed as the DMA base address, corrupting memory.
> 
> Bail out with -EINVAL when the BD list is empty, setting msg->status
> the same way the timeout path below does. The xfer_out cleanup path
> tolerates an empty list, and normal messages are unaffected.
> 
> This issue was found by static analysis.
> 
> Reported-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
> Reported-by: Li Ximo <lixicaicai@xxxxxxxxx>
> Signed-off-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
> ---


You've not provided a Signed-off-by for this so I can't do anything with
it, please see Documentation/process/submitting-patches.rst for details
on what this is and why it's important.

-- 
Mark Brown <broonie@xxxxxxxxxx>