diff options
| author | Martin Blumenstingl <martin.blumenstingl@googlemail.com> | 2017-12-15 14:42:04 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-12-23 16:46:23 +0100 |
| commit | 8a42d3fc9dfccbf601c5f58f46dc3cdbc1a4b923 (patch) | |
| tree | 3dd0098a410f0ffd4916bfc97574f4b23e11835b /drivers/nvmem | |
| parent | binder: fix proc->files use-after-free (diff) | |
| download | linux-8a42d3fc9dfccbf601c5f58f46dc3cdbc1a4b923.tar.xz linux-8a42d3fc9dfccbf601c5f58f46dc3cdbc1a4b923.zip | |
nvmem: meson-mx-efuse: fix reading from an offset other than 0
meson_mx_efuse_read calculates the address internal to the eFuse based
on the offset and the word size. This works fine with any given offset.
However, the offset is also included when writing to the output buffer.
This means that reading 4 bytes at offset 500 tries to write beyond the
array allocated by the nvmem core as it wants to write the 4 bytes to
"buffer address + offset (500)".
This issue did not show up in the previous tests since no driver uses
any value from the eFuse yet and reading the eFuse via sysfs simply
reads the whole eFuse, starting at offset 0.
Fix this by only including the offset in the internal address
calculation.
Fixes: 8caef1fa9176 ("nvmem: add a driver for the Amlogic Meson6/Meson8/Meson8b SoCs")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/nvmem')
| -rw-r--r-- | drivers/nvmem/meson-mx-efuse.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/nvmem/meson-mx-efuse.c b/drivers/nvmem/meson-mx-efuse.c index a346b4923550..41d3a3c1104e 100644 --- a/drivers/nvmem/meson-mx-efuse.c +++ b/drivers/nvmem/meson-mx-efuse.c @@ -156,8 +156,8 @@ static int meson_mx_efuse_read(void *context, unsigned int offset, MESON_MX_EFUSE_CNTL1_AUTO_RD_ENABLE, MESON_MX_EFUSE_CNTL1_AUTO_RD_ENABLE); - for (i = offset; i < offset + bytes; i += efuse->config.word_size) { - addr = i / efuse->config.word_size; + for (i = 0; i < bytes; i += efuse->config.word_size) { + addr = (offset + i) / efuse->config.word_size; err = meson_mx_efuse_read_addr(efuse, addr, &tmp); if (err) |