linux-kernel - [PATCH] spi: spi-imx: fix off-by-one in mx51 CPU mode burst length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <30b2a315b36e1ee16c0217b32b95a605@jessamine.co.uk>
Date: Wed, 13 Mar 2024 18:00:03 +0000
From: Adam Butcher <adam@...samine.co.uk>
To: Mark Brown <broonie@...nel.org>, shawnguo@...nel.org,
 s.hauer@...gutronix.de, kernel@...gutronix.de, linux-imx@....com,
 benjamin@...ler.one, stefanmoring@...il.com, carlos.song@....com
Cc: linux-spi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] spi: spi-imx: fix off-by-one in mx51 CPU mode burst length

 From: Adam Butcher <adam@...samine.co.uk>

992e1211dc91 ("spi: imx: fix the burst length at DMA mode and CPU mode")
corrects three cases of setting the ECSPI burst length but erroneously
leaves the in-range CPU case one bit to big (in that register a value of
0 means 1 bit).  The effect was that transmissions that should have been
8-bit bytes appeared as 9-bit causing failed communication with SPI
devices.

It seems the original patch submission up to v4 did not contain the bug.
It was introduced in the v5 update.

Link: 
https://lore.kernel.org/all/20240201105451.507005-1-carlos.song@nxp.com/
Link: 
https://lore.kernel.org/all/20240204091912.36488-1-carlos.song@nxp.com/
Fixes: 992e1211dc91 ("spi: imx: fix the burst length at DMA mode and CPU 
mode")
Signed-off-by: Adam Butcher <adam@...samine.co.uk>
---
  drivers/spi/spi-imx.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 7c1fcd5ed52f7..100552e6c56bc 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -743,8 +743,8 @@ static int mx51_ecspi_prepare_transfer(struct 
spi_imx_data *spi_imx,
  				ctrl |= (MX51_ECSPI_CTRL_MAX_BURST * BITS_PER_BYTE - 1)
  						<< MX51_ECSPI_CTRL_BL_OFFSET;
  			else
-				ctrl |= spi_imx->count / DIV_ROUND_UP(spi_imx->bits_per_word,
-						BITS_PER_BYTE) * spi_imx->bits_per_word
+				ctrl |= (spi_imx->count / DIV_ROUND_UP(spi_imx->bits_per_word,
+						BITS_PER_BYTE) * spi_imx->bits_per_word - 1)
  						<< MX51_ECSPI_CTRL_BL_OFFSET;
  		}
  	}
-- 
2.43.0