diff options
authorNicolas VINCENT <>2020-09-23 16:08:40 +0200
committerGreg Kroah-Hartman <>2020-10-07 08:02:52 +0200
commit95b874d021f62febafa4c74c611b38c2b2c14c82 (patch)
parentf6ae5ac641a886c90164a865bf56edd7c7013537 (diff)
i2c: cpm: Fix i2c_ram structure
[ Upstream commit a2bd970aa62f2f7f80fd0d212b1d4ccea5df4aed ] the i2c_ram structure is missing the sdmatmp field mentionned in datasheet for MPC8272 at paragraph 36.5. With this field missing, the hardware would write past the allocated memory done through cpm_muram_alloc for the i2c_ram structure and land in memory allocated for the buffers descriptors corrupting the cbd_bufaddr field. Since this field is only set during setup(), the first i2c transaction would work and the following would send data read from an arbitrary memory location. Fixes: 61045dbe9d8d ("i2c: Add support for I2C bus on Freescale CPM1/CPM2 controllers") Signed-off-by: Nicolas VINCENT <> Acked-by: Jochen Friedrich <> Acked-by: Christophe Leroy <> Signed-off-by: Wolfram Sang <> Signed-off-by: Sasha Levin <>
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index 1213e1932ccb..24d584a1c9a7 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -65,6 +65,9 @@ struct i2c_ram {
char res1[4]; /* Reserved */
ushort rpbase; /* Relocation pointer */
char res2[2]; /* Reserved */
+ /* The following elements are only for CPM2 */
+ char res3[4]; /* Reserved */
+ uint sdmatmp; /* Internal */
#define I2COM_START 0x80