linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	Nicolas VINCENT <nicolas.vincent@vossloh.com>,
	Jochen Friedrich <jochen@scram.de>,
	Christophe Leroy <christophe.leroy@csgroup.eu>,
	Wolfram Sang <wsa@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.4 43/57] i2c: cpm: Fix i2c_ram structure
Date: Mon,  5 Oct 2020 17:26:55 +0200	[thread overview]
Message-ID: <20201005142111.873935322@linuxfoundation.org> (raw)
In-Reply-To: <20201005142109.796046410@linuxfoundation.org>

From: Nicolas VINCENT <nicolas.vincent@vossloh.com>

[ Upstream commit a2bd970aa62f2f7f80fd0d212b1d4ccea5df4aed ]

the i2c_ram structure is missing the sdmatmp field mentionned in
datasheet for MPC8272 at paragraph 36.5. With this field missing, the
hardware would write past the allocated memory done through
cpm_muram_alloc for the i2c_ram structure and land in memory allocated
for the buffers descriptors corrupting the cbd_bufaddr field. Since this
field is only set during setup(), the first i2c transaction would work
and the following would send data read from an arbitrary memory
location.

Fixes: 61045dbe9d8d ("i2c: Add support for I2C bus on Freescale CPM1/CPM2 controllers")
Signed-off-by: Nicolas VINCENT <nicolas.vincent@vossloh.com>
Acked-by: Jochen Friedrich <jochen@scram.de>
Acked-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-cpm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index 1213e1932ccb5..24d584a1c9a78 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -65,6 +65,9 @@ struct i2c_ram {
 	char    res1[4];	/* Reserved */
 	ushort  rpbase;		/* Relocation pointer */
 	char    res2[2];	/* Reserved */
+	/* The following elements are only for CPM2 */
+	char    res3[4];	/* Reserved */
+	uint    sdmatmp;	/* Internal */
 };
 
 #define I2COM_START	0x80
-- 
2.25.1




  parent reply	other threads:[~2020-10-05 15:31 UTC|newest]

Thread overview: 63+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-05 15:26 [PATCH 5.4 00/57] 5.4.70-rc1 review Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 01/57] btrfs: fix filesystem corruption after a device replace Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 02/57] mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS models Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 03/57] USB: gadget: f_ncm: Fix NDP16 datagram validation Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 04/57] gpio: siox: explicitly support only threaded irqs Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 05/57] gpio: mockup: fix resource leak in error path Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 06/57] gpio: tc35894: fix up tc35894 interrupt configuration Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 07/57] clk: socfpga: stratix10: fix the divider for the emac_ptp_free_clk Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 08/57] vsock/virtio: add transport parameter to the virtio_transport_reset_no_sock() Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 09/57] net: virtio_vsock: Enhance connection semantics Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 10/57] xfs: trim IO to found COW extent limit Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 11/57] Input: i8042 - add nopnp quirk for Acer Aspire 5 A515 Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 12/57] iio: adc: qcom-spmi-adc5: fix driver name Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 13/57] ftrace: Move RCU is watching check after recursion check Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 14/57] memstick: Skip allocating card when removing host Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 15/57] drm/amdgpu: restore proper ref count in amdgpu_display_crtc_set_config Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 16/57] clocksource/drivers/timer-gx6605s: Fixup counter reload Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 17/57] libbpf: Remove arch-specific include path in Makefile Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 18/57] drivers/net/wan/hdlc_fr: Add needed_headroom for PVC devices Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 19/57] drm/sun4i: mixer: Extend regmap max_register Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 20/57] net: dec: de2104x: Increase receive ring size for Tulip Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 21/57] rndis_host: increase sleep time in the query-response loop Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 22/57] nvme-core: get/put ctrl and transport module in nvme_dev_open/release() Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 23/57] fuse: fix the ->direct_IO() treatment of iov_iter Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 24/57] drivers/net/wan/lapbether: Make skb->protocol consistent with the header Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 25/57] drivers/net/wan/hdlc: Set skb->protocol before transmitting Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 26/57] mac80211: Fix radiotap header channel flag for 6GHz band Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 27/57] mac80211: do not allow bigger VHT MPDUs than the hardware supports Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 28/57] tracing: Make the space reserved for the pid wider Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 29/57] tools/io_uring: fix compile breakage Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 30/57] spi: fsl-espi: Only process interrupts for expected events Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 31/57] nvme-pci: fix NULL req in completion handler Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 32/57] nvme-fc: fail new connections to a deleted host or remote port Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 33/57] gpio: sprd: Clear interrupt when setting the type as edge Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 34/57] phy: ti: am654: Fix a leak in serdes_am654_probe() Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 35/57] pinctrl: mvebu: Fix i2c sda definition for 98DX3236 Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 36/57] nfs: Fix security label length not being reset Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 37/57] clk: tegra: Always program PLL_E when enabled Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 38/57] clk: samsung: exynos4: mark chipid clock as CLK_IGNORE_UNUSED Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 39/57] iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate() Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 40/57] gpio/aspeed-sgpio: enable access to all 80 input & output sgpios Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 41/57] gpio/aspeed-sgpio: dont enable all interrupts by default Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 42/57] gpio: aspeed: fix ast2600 bank properties Greg Kroah-Hartman
2020-10-05 15:26 ` Greg Kroah-Hartman [this message]
2020-10-05 15:26 ` [PATCH 5.4 44/57] Input: trackpoint - enable Synaptics trackpoints Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 45/57] scripts/dtc: only append to HOST_EXTRACFLAGS instead of overwriting Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 46/57] random32: Restore __latent_entropy attribute on net_rand_state Greg Kroah-Hartman
2020-10-05 15:26 ` [PATCH 5.4 47/57] block/diskstats: more accurate approximation of io_ticks for slow disks Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.4 48/57] mm: replace memmap_context by meminit_context Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.4 49/57] mm: dont rely on system state to detect hot-plug operations Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.4 50/57] nvme: Cleanup and rename nvme_block_nr() Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.4 51/57] nvme: Introduce nvme_lba_to_sect() Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.4 52/57] nvme: consolidate chunk_sectors settings Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.4 53/57] epoll: do not insert into poll queues until all sanity checks are done Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.4 54/57] epoll: replace ->visited/visited_list with generation count Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.4 55/57] epoll: EPOLL_CTL_ADD: close the race in decision to take fast path Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.4 56/57] ep_create_wakeup_source(): dentry name can change under you Greg Kroah-Hartman
2020-10-05 15:27 ` [PATCH 5.4 57/57] netfilter: ctnetlink: add a range check for l3/l4 protonum Greg Kroah-Hartman
2020-10-06  0:22 ` [PATCH 5.4 00/57] 5.4.70-rc1 review Shuah Khan
2020-10-06  5:54 ` Naresh Kamboju
2020-10-06  8:25   ` Naresh Kamboju
2020-10-06 14:49     ` Ben Hutchings
2020-10-06 18:17 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201005142111.873935322@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=christophe.leroy@csgroup.eu \
    --cc=jochen@scram.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nicolas.vincent@vossloh.com \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=wsa@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).