Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 60361601 authored by Hoan Tran's avatar Hoan Tran Committed by Wolfram Sang
Browse files

i2c: xgene: Avoid dma_buffer overrun 



SMBus block command uses the first byte of buffer for the data length.
The dma_buffer should be increased by 1 to avoid the overrun issue.

Reported-by: default avatarPhil Endecott <phil_gjouf_endecott@chezphil.org>
Signed-off-by: default avatarHoan Tran <hotran@apm.com>
Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
Cc: stable@kernel.org
parent 60a951af

drivers/i2c/busses/i2c-xgene-slimpro.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -105,7 +105,7 @@ struct slimpro_i2c_dev { 
	struct mbox_chan *mbox_chan;

	struct mbox_chan *mbox_chan;

	struct mbox_client mbox_client;

	struct mbox_client mbox_client;

	struct completion rd_complete;

	struct completion rd_complete;

	u8 dma_buffer[I2C_SMBUS_BLOCK_MAX];

	u8 dma_buffer[I2C_SMBUS_BLOCK_MAX + 1]; /* dma_buffer[0] is used for length */

	u32 *resp_msg;

	u32 *resp_msg;

};

};