diff options
| author | Gong Qianyu | 2016-01-26 15:06:41 +0800 |
|---|---|---|
| committer | York Sun | 2016-01-27 08:28:31 -0800 |
| commit | 940d2b89bf36c17dfc9972111b68391c35b4e9f2 (patch) | |
| tree | 07c18d216f39698f8ce8dae47a7e2c67aaf3bc7d | |
| parent | 5207014deb1a465d2ac808254902100e7ea69d75 (diff) | |
spi: fsl_qspi: Fix qspi_op_rdsr memcpy issue
In current driver, we always copy 4 bytes to the dest memory.
Actually the dest memory may be shorter than 4 bytes.
Add an argument to indicate the dest memory length.
Avoid writing memory outside of the bounds.
Signed-off-by: Gong Qianyu <Qianyu.Gong@freescale.com>
Reviewed-by: York Sun <york.sun@nxp.com>
| -rw-r--r-- | drivers/spi/fsl_qspi.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/spi/fsl_qspi.c b/drivers/spi/fsl_qspi.c index 3553e0038fa..cb8d929d074 100644 --- a/drivers/spi/fsl_qspi.c +++ b/drivers/spi/fsl_qspi.c @@ -639,7 +639,7 @@ static void qspi_op_write(struct fsl_qspi_priv *priv, u8 *txbuf, u32 len) qspi_write32(priv->flags, ®s->mcr, mcr_reg); } -static void qspi_op_rdsr(struct fsl_qspi_priv *priv, u32 *rxbuf) +static void qspi_op_rdsr(struct fsl_qspi_priv *priv, void *rxbuf, u32 len) { struct fsl_qspi_regs *regs = priv->regs; u32 mcr_reg, reg, data; @@ -662,7 +662,7 @@ static void qspi_op_rdsr(struct fsl_qspi_priv *priv, u32 *rxbuf) if (reg & QSPI_RBSR_RDBFL_MASK) { data = qspi_read32(priv->flags, ®s->rbdr[0]); data = qspi_endian_xchg(data); - memcpy(rxbuf, &data, 4); + memcpy(rxbuf, &data, len); qspi_write32(priv->flags, ®s->mcr, qspi_read32(priv->flags, ®s->mcr) | QSPI_MCR_CLR_RXF_MASK); @@ -751,7 +751,7 @@ int qspi_xfer(struct fsl_qspi_priv *priv, unsigned int bitlen, } else if (priv->cur_seqid == QSPI_CMD_RDID) qspi_op_rdid(priv, din, bytes); else if (priv->cur_seqid == QSPI_CMD_RDSR) - qspi_op_rdsr(priv, din); + qspi_op_rdsr(priv, din, bytes); #ifdef CONFIG_SPI_FLASH_BAR else if ((priv->cur_seqid == QSPI_CMD_BRRD) || (priv->cur_seqid == QSPI_CMD_RDEAR)) { |