Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 37880c90 authored by christophe leroy's avatar christophe leroy Committed by Grant Likely
Browse files

spi/mpc8xxx: fix buffer overrun on large transfers 



It fixes an issue when sending-only or receiving-only more than
PAGE_SIZE bytes.

Signed-off-by: default avatarchristophe leroy <christophe.leroy@c-s.fr>
Acked-by: default avatarJoakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: default avatarGrant Likely <grant.likely@secretlab.ca>
parent 9c03f162

drivers/spi/spi_mpc8xxx.c

+8 −2
Original line number Diff line number Diff line
@@ -408,10 +408,16 @@ static void mpc8xxx_spi_cpm_bufs_start(struct mpc8xxx_spi *mspi) 


	xfer_ofs = mspi->xfer_in_progress->len - mspi->count;



	if (mspi->rx_dma == mspi->dma_dummy_rx)

		out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma);

	else

		out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);

	out_be16(&rx_bd->cbd_datlen, 0);

	out_be16(&rx_bd->cbd_sc, BD_SC_EMPTY | BD_SC_INTRPT | BD_SC_WRAP);



	if (mspi->tx_dma == mspi->dma_dummy_tx)

		out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma);

	else

		out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);

	out_be16(&tx_bd->cbd_datlen, xfer_len);

	out_be16(&tx_bd->cbd_sc, BD_SC_READY | BD_SC_INTRPT | BD_SC_WRAP |