Skip to content

Commit 007ae33

Browse files
qnguyen-amperesmb49
authored andcommitted
i2c: designware: Correct length byte validation logic
BugLink: https://bugs.launchpad.net/bugs/2039110 commit 49d4db3 upstream. Commit 0daede8 ("i2c: designware: Convert driver to using regmap API") changes the logic to validate the whole 32-bit return value of DW_IC_DATA_CMD register instead of 8-bit LSB without reason. Later, commit f53f15b ("i2c: designware: Get right data length"), introduced partial fix but not enough because the "tmp > 0" still test tmp as 32-bit value and is wrong in case the IC_DATA_CMD[11] is set. Revert the logic to just before commit 0daede8 ("i2c: designware: Convert driver to using regmap API"). Fixes: f53f15b ("i2c: designware: Get right data length") Fixes: 0daede8 ("i2c: designware: Convert driver to using regmap API") Cc: stable@vger.kernel.org Signed-off-by: Tam Nguyen <tamnguyenchi@os.amperecomputing.com> Signed-off-by: Quan Nguyen <quan@os.amperecomputing.com> Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com> Link: https://lore.kernel.org/r/20230726080001.337353-2-tamnguyenchi@os.amperecomputing.com Reviewed-by: Andi Shyti <andi.shyti@kernel.org> Signed-off-by: Wolfram Sang <wsa@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Kamal Mostafa <kamal@canonical.com> Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
1 parent 984b9dc commit 007ae33

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

drivers/i2c/busses/i2c-designware-master.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -525,9 +525,10 @@ i2c_dw_read(struct dw_i2c_dev *dev)
525525
u32 flags = msgs[dev->msg_read_idx].flags;
526526

527527
regmap_read(dev->map, DW_IC_DATA_CMD, &tmp);
528+
tmp &= DW_IC_DATA_CMD_DAT;
528529
/* Ensure length byte is a valid value */
529530
if (flags & I2C_M_RECV_LEN &&
530-
(tmp & DW_IC_DATA_CMD_DAT) <= I2C_SMBUS_BLOCK_MAX && tmp > 0) {
531+
tmp <= I2C_SMBUS_BLOCK_MAX && tmp > 0) {
531532
len = i2c_dw_recv_len(dev, tmp);
532533
}
533534
*buf++ = tmp;

0 commit comments

Comments
 (0)