Messages in this thread | | | From | Arnd Bergmann <> | Date | Mon, 8 Nov 2021 19:27:07 +0100 | Subject | Re: [PATCH v2] nvmem: eeprom: at25: fix FRAM byte_len |
| |
On Mon, Nov 8, 2021 at 7:16 PM Ralph Siemsen <ralph.siemsen@linaro.org> wrote: > > Commit fd307a4ad332 ("nvmem: prepare basics for FRAM support") added > support for FRAM devices such as the Cypress FM25V. During testing, it > was found that the FRAM detects properly, however reads and writes fail. > Upon further investigation, two problem were found in at25_probe() routine. > > 1) In the case of an FRAM device without platform data, eg. > fram == true && spi->dev.platform_data == NULL > the stack local variable "struct spi_eeprom chip" is not initialized > fully, prior to being copied into at25->chip. The chip.flags field in > particular can cause problems. > > 2) The byte_len of FRAM is computed from its ID register, and is stored > into the stack local "struct spi_eeprom chip" structure. This happens > after the same structure has been copied into at25->chip. As a result, > at25->chip.byte_len does not contain the correct length of the device. > In turn this can cause checks at beginning of at25_ee_read() to fail > (or equally, it could allow reads beyond the end of the device length). > > Fix both of these issues by eliminating the on-stack struct spi_eeprom. > Instead use the one inside at25_data structure, which starts of zeroed. > > Fixes: fd307a4ad332 ("nvmem: prepare basics for FRAM support") > Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
| |