angler-fishThe Vulnerability History Project

iQFHBAABCgAxFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAl4OkfwTHGJyb29uaWVA

      a2VybmVsLm9yZwAKCRAk1otyXVSH0Js0B/4q/qnM6hnfF8VLglRbigJfYNyx1GEx
 nOLBW2Jx0lh3EltVug8jUDTtSwrZS7EDfGYgI011r2AaE5/kIiPi8qees+U+Pkp0
 Alp89aVB/kyG+36cmUfRA28Sp4T/uzQrJ6TN3Avw/4zKSwT54XU1uj3NzNxBuxKv
 E8ETqyoMGRbtE4vSDMPiR/aOekir0qP2lLBD0mjec5Onxb3un2+597yet8DWI3Nc
 leRJRm7pI8l+eWdMY8y/pGyONcT1wryEPMANvduxeIYQ4Z/No61evwmUXIGbm4K3
 0VcJ2U2UoTNqyJFzCXgFCA+c7NcduIZ9m6iQFTiXTQZir/DPMfdC9J39
 =85/x
 -----END PGP SIGNATURE-----

spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls

dw_spi_irq() and dw_spi_transfer_one concurrent calls.

I find a panic in dw_writer(): txw = *(u8 *)(dws->tx), when dw->tx==null,
dw->len==4, and dw->tx_end==1.

When tpm driver's message overtime dw_spi_irq() and dw_spi_transfer_one
may concurrent visit dw_spi, so I think dw_spi structure lack of protection.

Otherwise dw_spi_transfer_one set dw rx/tx buffer and then open irq,
store dw rx/tx instructions and other cores handle irq lo
    
commit 19b61392c5a852b4e8a0bf35aecb969983c5932d
+12 -3
+1
expand_less