diff options
| author | Nicolas VINCENT <nicolas.vincent@vossloh.com> | 2020-09-23 16:08:40 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-10-07 08:00:08 +0200 |
| commit | 69e0a9eb6c49ccbf1d565e8a4d188132af3df70e (patch) | |
| tree | 52a51bda96cd3aa716597eba804ba33dbfe784a3 | |
| parent | 543db1d99b0993d891acd91f667202fa17140e51 (diff) | |
| download | linux-stable-69e0a9eb6c49ccbf1d565e8a4d188132af3df70e.tar.gz linux-stable-69e0a9eb6c49ccbf1d565e8a4d188132af3df70e.tar.bz2 linux-stable-69e0a9eb6c49ccbf1d565e8a4d188132af3df70e.zip | |
i2c: cpm: Fix i2c_ram structure
[ Upstream commit a2bd970aa62f2f7f80fd0d212b1d4ccea5df4aed ]
the i2c_ram structure is missing the sdmatmp field mentionned in
datasheet for MPC8272 at paragraph 36.5. With this field missing, the
hardware would write past the allocated memory done through
cpm_muram_alloc for the i2c_ram structure and land in memory allocated
for the buffers descriptors corrupting the cbd_bufaddr field. Since this
field is only set during setup(), the first i2c transaction would work
and the following would send data read from an arbitrary memory
location.
Fixes: 61045dbe9d8d ("i2c: Add support for I2C bus on Freescale CPM1/CPM2 controllers")
Signed-off-by: Nicolas VINCENT <nicolas.vincent@vossloh.com>
Acked-by: Jochen Friedrich <jochen@scram.de>
Acked-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/i2c/busses/i2c-cpm.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c index 8a8ca945561b..7eba874a981d 100644 --- a/drivers/i2c/busses/i2c-cpm.c +++ b/drivers/i2c/busses/i2c-cpm.c @@ -74,6 +74,9 @@ struct i2c_ram { char res1[4]; /* Reserved */ ushort rpbase; /* Relocation pointer */ char res2[2]; /* Reserved */ + /* The following elements are only for CPM2 */ + char res3[4]; /* Reserved */ + uint sdmatmp; /* Internal */ }; #define I2COM_START 0x80 |