| Message ID | 1476119590-21489-1-git-send-email-hotran@apm.com |
|---|---|
| State | Accepted |
| Headers | show |
On Mon, Oct 10, 2016 at 10:13 AM, Hoan Tran <hotran@apm.com> wrote: > SMBus block command uses the first byte of buffer for the data length. > The dma_buffer should be increased by 1 to avoid the overrun issue. > > Reported-by: Phil Endecott <phil_gjouf_endecott@chezphil.org> > Signed-off-by: Hoan Tran <hotran@apm.com> > --- > drivers/i2c/busses/i2c-xgene-slimpro.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c > index 4233f56..3c38029 100644 > --- a/drivers/i2c/busses/i2c-xgene-slimpro.c > +++ b/drivers/i2c/busses/i2c-xgene-slimpro.c > @@ -105,7 +105,7 @@ struct slimpro_i2c_dev { > struct mbox_chan *mbox_chan; > struct mbox_client mbox_client; > struct completion rd_complete; > - u8 dma_buffer[I2C_SMBUS_BLOCK_MAX]; > + u8 dma_buffer[I2C_SMBUS_BLOCK_MAX + 1]; /* dma_buffer[0] is used for length */ > u32 *resp_msg; > }; > > -- > 1.9.1 > Any comments on this patch. Thanks Hoan -- To unsubscribe from this list: send the line "unsubscribe linux-i2c" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, Oct 10, 2016 at 10:13:10AM -0700, Hoan Tran wrote: > SMBus block command uses the first byte of buffer for the data length. > The dma_buffer should be increased by 1 to avoid the overrun issue. > > Reported-by: Phil Endecott <phil_gjouf_endecott@chezphil.org> > Signed-off-by: Hoan Tran <hotran@apm.com> Added stable and applied to for-current, thanks!
diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c index 4233f56..3c38029 100644 --- a/drivers/i2c/busses/i2c-xgene-slimpro.c +++ b/drivers/i2c/busses/i2c-xgene-slimpro.c @@ -105,7 +105,7 @@ struct slimpro_i2c_dev { struct mbox_chan *mbox_chan; struct mbox_client mbox_client; struct completion rd_complete; - u8 dma_buffer[I2C_SMBUS_BLOCK_MAX]; + u8 dma_buffer[I2C_SMBUS_BLOCK_MAX + 1]; /* dma_buffer[0] is used for length */ u32 *resp_msg; };
SMBus block command uses the first byte of buffer for the data length. The dma_buffer should be increased by 1 to avoid the overrun issue. Reported-by: Phil Endecott <phil_gjouf_endecott@chezphil.org> Signed-off-by: Hoan Tran <hotran@apm.com> --- drivers/i2c/busses/i2c-xgene-slimpro.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)