From mboxrd@z Thu Jan 1 00:00:00 1970 From: york sun Date: Tue, 19 Jan 2016 18:47:25 +0000 Subject: [U-Boot] [Patch V4 2/4] spi: fsl_qspi: Fix qspi_op_rdid memcpy issue References: <1452478010-5958-1-git-send-email-Qianyu.Gong@nxp.com> Message-ID: List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de On 01/10/2016 06:15 PM, Gong Qianyu wrote: > From: Gong Qianyu > > In current driver everytime we memcpy 4 bytes to the dest memory > regardless of the remaining length. > This patch adds checking the remaining length before memcpy. > If the length is shorter than 4 bytes, memcpy the actual length of data > to the dest memory. > > Signed-off-by: Gong Qianyu > --- > V2-V4: > - No change. > > drivers/spi/fsl_qspi.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/spi/fsl_qspi.c b/drivers/spi/fsl_qspi.c > index 9f23c10..4d58211 100644 > --- a/drivers/spi/fsl_qspi.c > +++ b/drivers/spi/fsl_qspi.c > @@ -500,7 +500,10 @@ static void qspi_op_rdid(struct fsl_qspi_priv *priv, u32 *rxbuf, u32 len) > if (rbsr_reg & QSPI_RBSR_RDBFL_MASK) { > data = qspi_read32(priv->flags, ®s->rbdr[i]); > data = qspi_endian_xchg(data); > - memcpy(rxbuf, &data, 4); > + if (size < 4) > + memcpy(rxbuf, &data, size); > + else > + memcpy(rxbuf, &data, 4); > rxbuf++; > size -= 4; > i++; > Doesn't the line "size -= 4" need a fix as well? I guess it runs OK for checking (size > 0), but it looks odd. York