On Mon, Jun 15, 2020 at 05:03:30PM +0200, gregkh@xxxxxxxxxxxxxxxxxxx wrote:
The patch below does not apply to the 5.7-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@xxxxxxxxxxxxxxx>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From f5f27b79eab80de0287c243a22169e4876b08d5e Mon Sep 17 00:00:00 2001
From: Franck LENORMAND <franck.lenormand@xxxxxxx>
Date: Thu, 26 Mar 2020 00:00:05 +0200
Subject: [PATCH] firmware: imx: scu: Fix corruption of header
The header of the message to send can be changed if the
response is longer than the request:
- 1st word, the header is sent
- the remaining words of the message are sent
- the response is received asynchronously during the
execution of the loop, changing the size field in
the header
- the for loop test the termination condition using
the corrupted header
It is the case for the API build_info which has just a
header as request but 3 words in response.
This issue is fixed storing the header locally instead of
using a pointer on it.
Fixes: edbee095fafb (firmware: imx: add SCU firmware driver support)
Signed-off-by: Franck LENORMAND <franck.lenormand@xxxxxxx>
Reviewed-by: Leonard Crestez <leonard.crestez@xxxxxxx>
Signed-off-by: Leonard Crestez <leonard.crestez@xxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Reviewed-by: Dong Aisheng <aisheng.dong@xxxxxxx>
Signed-off-by: Shawn Guo <shawnguo@xxxxxxxxxx>
I've also grabbed f25a066d1a07 ("firmware: imx-scu: Support one TX and
one RX") for 5.7, 5.6, and 5.4.
--
Thanks,
Sasha
