| Message ID | 20200923140840.8700-1-nicolas.vincent@vossloh.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] i2c: cpm: Fix i2c_ram structure | expand |
Acked-by: Jochen Friedrich <jochen@scram.de> Am 23.09.2020 um 16:08 schrieb nico.vince@gmail.com: > From: Nicolas VINCENT <nicolas.vincent@vossloh.com> > > the i2c_ram structure is missing the sdmatmp field mentionned in > datasheet for MPC8272 at paragraph 36.5. With this field missing, the > hardware would write past the allocated memory done through > cpm_muram_alloc for the i2c_ram structure and land in memory allocated > for the buffers descriptors corrupting the cbd_bufaddr field. Since this > field is only set during setup(), the first i2c transaction would work > and the following would send data read from an arbitrary memory > location. > > Signed-off-by: Nicolas VINCENT <nicolas.vincent@vossloh.com> > --- > drivers/i2c/busses/i2c-cpm.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c > index 1213e1932ccb..24d584a1c9a7 100644 > --- a/drivers/i2c/busses/i2c-cpm.c > +++ b/drivers/i2c/busses/i2c-cpm.c > @@ -65,6 +65,9 @@ struct i2c_ram { > char res1[4]; /* Reserved */ > ushort rpbase; /* Relocation pointer */ > char res2[2]; /* Reserved */ > + /* The following elements are only for CPM2 */ > + char res3[4]; /* Reserved */ > + uint sdmatmp; /* Internal */ > }; > > #define I2COM_START 0x80 >
On Wed, Sep 23, 2020 at 04:08:40PM +0200, nico.vince@gmail.com wrote: > From: Nicolas VINCENT <nicolas.vincent@vossloh.com> > > the i2c_ram structure is missing the sdmatmp field mentionned in > datasheet for MPC8272 at paragraph 36.5. With this field missing, the > hardware would write past the allocated memory done through > cpm_muram_alloc for the i2c_ram structure and land in memory allocated > for the buffers descriptors corrupting the cbd_bufaddr field. Since this > field is only set during setup(), the first i2c transaction would work > and the following would send data read from an arbitrary memory > location. > > Signed-off-by: Nicolas VINCENT <nicolas.vincent@vossloh.com> Thanks! Is someone able to identify a Fixes: tag I could add? > --- > drivers/i2c/busses/i2c-cpm.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c > index 1213e1932ccb..24d584a1c9a7 100644 > --- a/drivers/i2c/busses/i2c-cpm.c > +++ b/drivers/i2c/busses/i2c-cpm.c > @@ -65,6 +65,9 @@ struct i2c_ram { > char res1[4]; /* Reserved */ > ushort rpbase; /* Relocation pointer */ > char res2[2]; /* Reserved */ > + /* The following elements are only for CPM2 */ > + char res3[4]; /* Reserved */ > + uint sdmatmp; /* Internal */ > }; > > #define I2COM_START 0x80 > -- > 2.17.1 >
Le 23/09/2020 à 18:08, Wolfram Sang a écrit : > On Wed, Sep 23, 2020 at 04:08:40PM +0200, nico.vince@gmail.com wrote: >> From: Nicolas VINCENT <nicolas.vincent@vossloh.com> >> >> the i2c_ram structure is missing the sdmatmp field mentionned in >> datasheet for MPC8272 at paragraph 36.5. With this field missing, the >> hardware would write past the allocated memory done through >> cpm_muram_alloc for the i2c_ram structure and land in memory allocated >> for the buffers descriptors corrupting the cbd_bufaddr field. Since this >> field is only set during setup(), the first i2c transaction would work >> and the following would send data read from an arbitrary memory >> location. >> >> Signed-off-by: Nicolas VINCENT <nicolas.vincent@vossloh.com> > > Thanks! > > Is someone able to identify a Fixes: tag I could add? I'd suggest Fixes: 61045dbe9d8d ("i2c: Add support for I2C bus on Freescale CPM1/CPM2 controllers") Christophe > >> --- >> drivers/i2c/busses/i2c-cpm.c | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c >> index 1213e1932ccb..24d584a1c9a7 100644 >> --- a/drivers/i2c/busses/i2c-cpm.c >> +++ b/drivers/i2c/busses/i2c-cpm.c >> @@ -65,6 +65,9 @@ struct i2c_ram { >> char res1[4]; /* Reserved */ >> ushort rpbase; /* Relocation pointer */ >> char res2[2]; /* Reserved */ >> + /* The following elements are only for CPM2 */ >> + char res3[4]; /* Reserved */ >> + uint sdmatmp; /* Internal */ >> }; >> >> #define I2COM_START 0x80 >> -- >> 2.17.1 >>
On Wed, Sep 23, 2020 at 04:08:40PM +0200, nico.vince@gmail.com wrote: > From: Nicolas VINCENT <nicolas.vincent@vossloh.com> > > the i2c_ram structure is missing the sdmatmp field mentionned in > datasheet for MPC8272 at paragraph 36.5. With this field missing, the > hardware would write past the allocated memory done through > cpm_muram_alloc for the i2c_ram structure and land in memory allocated > for the buffers descriptors corrupting the cbd_bufaddr field. Since this > field is only set during setup(), the first i2c transaction would work > and the following would send data read from an arbitrary memory > location. > > Signed-off-by: Nicolas VINCENT <nicolas.vincent@vossloh.com> Fixes tag aded and applied to for-current, thanks everyone!
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c index 1213e1932ccb..24d584a1c9a7 100644 --- a/drivers/i2c/busses/i2c-cpm.c +++ b/drivers/i2c/busses/i2c-cpm.c @@ -65,6 +65,9 @@ struct i2c_ram { char res1[4]; /* Reserved */ ushort rpbase; /* Relocation pointer */ char res2[2]; /* Reserved */ + /* The following elements are only for CPM2 */ + char res3[4]; /* Reserved */ + uint sdmatmp; /* Internal */ }; #define I2COM_START 0x80