diff options
| author | christophe leroy <christophe.leroy@c-s.fr> | 2010-09-16 09:05:25 +0200 |
|---|---|---|
| committer | Grant Likely <grant.likely@secretlab.ca> | 2010-09-16 14:07:45 -0600 |
| commit | 37880c909c6a22674d3c0f83f2737264b4e60fe1 (patch) | |
| tree | afb1c3738a0b8280db309cfc7c243ca556e8062f /drivers/spi | |
| parent | 9c03f1622af051004416dd3e24d8a0fa31e34178 (diff) | |
| download | linux-37880c909c6a22674d3c0f83f2737264b4e60fe1.tar.gz linux-37880c909c6a22674d3c0f83f2737264b4e60fe1.tar.bz2 linux-37880c909c6a22674d3c0f83f2737264b4e60fe1.zip | |
spi/mpc8xxx: fix buffer overrun on large transfers
It fixes an issue when sending-only or receiving-only more than
PAGE_SIZE bytes.
Signed-off-by: christophe leroy <christophe.leroy@c-s.fr>
Acked-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Diffstat (limited to 'drivers/spi')
| -rw-r--r-- | drivers/spi/spi_mpc8xxx.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/spi/spi_mpc8xxx.c b/drivers/spi/spi_mpc8xxx.c index d31b57f7baaf..1dd86b835cd8 100644 --- a/drivers/spi/spi_mpc8xxx.c +++ b/drivers/spi/spi_mpc8xxx.c @@ -408,11 +408,17 @@ static void mpc8xxx_spi_cpm_bufs_start(struct mpc8xxx_spi *mspi) xfer_ofs = mspi->xfer_in_progress->len - mspi->count; - out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs); + if (mspi->rx_dma == mspi->dma_dummy_rx) + out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma); + else + out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs); out_be16(&rx_bd->cbd_datlen, 0); out_be16(&rx_bd->cbd_sc, BD_SC_EMPTY | BD_SC_INTRPT | BD_SC_WRAP); - out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs); + if (mspi->tx_dma == mspi->dma_dummy_tx) + out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma); + else + out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs); out_be16(&tx_bd->cbd_datlen, xfer_len); out_be16(&tx_bd->cbd_sc, BD_SC_READY | BD_SC_INTRPT | BD_SC_WRAP | BD_SC_LAST); |