There is a case when a we want to read a large number of bytes that
require a burst but is not a multiple of the word size (8). When this
happens rt5677_spi_reverse will run off the end of the buffer. The
solution is to tell spi_reverse the actual size of the destination and
stop if we reach it even if we have data left that we read.
Cc: Ben Zhang <benzh@xxxxxxxxxxxx>
Signed-off-by: Curtis Malainey <cujomalainey@xxxxxxxxxxxx>
---
sound/soc/codecs/rt5677-spi.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/rt5677-spi.c b/sound/soc/codecs/rt5677-spi.c
index 84b6bd8b50e1..a4dfa0345c6e 100644
--- a/sound/soc/codecs/rt5677-spi.c
+++ b/sound/soc/codecs/rt5677-spi.c
@@ -101,7 +101,7 @@ static void rt5677_spi_reverse(u8 *dst, u32 dstlen, const u8 *src, u32 srclen)
u32 word_size = min_t(u32, dstlen, 8);
for (w = 0; w < dstlen; w += word_size) {
- for (i = 0; i < word_size; i++) {
+ for (i = 0; i < word_size && i + w < dstlen; i++) {
si = w + word_size - i - 1;
dst[w + i] = si < srclen ? src[si] : 0;
}
@@ -152,8 +152,9 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
status |= spi_sync(g_spi, &m);
mutex_unlock(&spi_mutex);
+
/* Copy data back to caller buffer */
- rt5677_spi_reverse(cb + offset, t[1].len, body, t[1].len);
+ rt5677_spi_reverse(cb + offset, len - offset, body, t[1].len);
}
return status;
}
--
2.21.0.1020.gf2820cf01a-goog
_______________________________________________
Alsa-devel mailing list
Alsa-devel@xxxxxxxxxxxxxxxx
https://mailman.alsa-project.org/mailman/listinfo/alsa-devel
