On Thu, Jun 16, 2022 at 11:49:14AM +0200, Marc Kleine-Budde wrote:
> The device ID register is 32 bits wide. The driver uses incorrectly
> the size of a pointer to a u32 to calculate the length of the SPI
> transfer. This results in a read of 2 registers on 64 bit platforms.
> This is no problem on the Linux side, as the RX buffer of the SPI
> transfer is large enough. In the mpc251xfd chip this results in the
> read of an undocumented register. So far no problems were observed.
>
> This patch fixes the length of the SPI transfer to read the device ID
> register only.
>
> Fixes: 55e5b97f003e ("can: mcp25xxfd: add driver for Microchip MCP25xxFD SPI CAN")
> Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@xxxxxxxxxx>
Thanks,
Mani
> ---
> drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
> index 34b160024ce3..3160881e89d9 100644
> --- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
> +++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
> @@ -1778,7 +1778,7 @@ mcp251xfd_register_get_dev_id(const struct mcp251xfd_priv *priv, u32 *dev_id,
> xfer[0].len = sizeof(buf_tx->cmd);
> xfer[0].speed_hz = priv->spi_max_speed_hz_slow;
> xfer[1].rx_buf = buf_rx->data;
> - xfer[1].len = sizeof(dev_id);
> + xfer[1].len = sizeof(*dev_id);
> xfer[1].speed_hz = priv->spi_max_speed_hz_fast;
>
> mcp251xfd_spi_cmd_read_nocrc(&buf_tx->cmd, MCP251XFD_REG_DEVID);
> --
> 2.35.1
>
>
--
மணிவண்ணன் சதாசிவம்
