Re: [PATCH v2] i2c: cpm: Fix i2c_ram structure
From: Wolfram Sang <wsa@kernel.org>
Date: 2020-09-23 16:11:10
Also in:
linux-i2c
On Wed, Sep 23, 2020 at 04:08:40PM +0200, nico.vince@gmail.com wrote:
From: Nicolas VINCENT <redacted> the i2c_ram structure is missing the sdmatmp field mentionned in datasheet for MPC8272 at paragraph 36.5. With this field missing, the hardware would write past the allocated memory done through cpm_muram_alloc for the i2c_ram structure and land in memory allocated for the buffers descriptors corrupting the cbd_bufaddr field. Since this field is only set during setup(), the first i2c transaction would work and the following would send data read from an arbitrary memory location. Signed-off-by: Nicolas VINCENT <redacted>
Thanks! Is someone able to identify a Fixes: tag I could add?
quoted hunk ↗ jump to hunk
--- drivers/i2c/busses/i2c-cpm.c | 3 +++ 1 file changed, 3 insertions(+)diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c index 1213e1932ccb..24d584a1c9a7 100644 --- a/drivers/i2c/busses/i2c-cpm.c +++ b/drivers/i2c/busses/i2c-cpm.c@@ -65,6 +65,9 @@ struct i2c_ram { char res1[4]; /* Reserved */ ushort rpbase; /* Relocation pointer */ char res2[2]; /* Reserved */ + /* The following elements are only for CPM2 */ + char res3[4]; /* Reserved */ + uint sdmatmp; /* Internal */ }; #define I2COM_START 0x80-- 2.17.1
Attachments
- signature.asc [application/pgp-signature] 833 bytes