| From aab61ae1847bec9c6f5f3edc8243cbfec74e7bfe Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 23 Sep 2020 16:08:40 +0200 |
| Subject: i2c: cpm: Fix i2c_ram structure |
| |
| From: Nicolas VINCENT <nicolas.vincent@vossloh.com> |
| |
| [ Upstream commit a2bd970aa62f2f7f80fd0d212b1d4ccea5df4aed ] |
| |
| the i2c_ram structure is missing the sdmatmp field mentionned in |
| datasheet for MPC8272 at paragraph 36.5. With this field missing, the |
| hardware would write past the allocated memory done through |
| cpm_muram_alloc for the i2c_ram structure and land in memory allocated |
| for the buffers descriptors corrupting the cbd_bufaddr field. Since this |
| field is only set during setup(), the first i2c transaction would work |
| and the following would send data read from an arbitrary memory |
| location. |
| |
| Fixes: 61045dbe9d8d ("i2c: Add support for I2C bus on Freescale CPM1/CPM2 controllers") |
| Signed-off-by: Nicolas VINCENT <nicolas.vincent@vossloh.com> |
| Acked-by: Jochen Friedrich <jochen@scram.de> |
| Acked-by: Christophe Leroy <christophe.leroy@csgroup.eu> |
| Signed-off-by: Wolfram Sang <wsa@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/i2c/busses/i2c-cpm.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c |
| index d89bde2c5da25..cf285b97a6422 100644 |
| --- a/drivers/i2c/busses/i2c-cpm.c |
| +++ b/drivers/i2c/busses/i2c-cpm.c |
| @@ -74,6 +74,9 @@ struct i2c_ram { |
| char res1[4]; /* Reserved */ |
| ushort rpbase; /* Relocation pointer */ |
| char res2[2]; /* Reserved */ |
| + /* The following elements are only for CPM2 */ |
| + char res3[4]; /* Reserved */ |
| + uint sdmatmp; /* Internal */ |
| }; |
| |
| #define I2COM_START 0x80 |
| -- |
| 2.25.1 |
| |
