diff options
| author | Andy Shevchenko <andy.shevchenko@gmail.com> | 2024-06-05 23:53:15 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-09-08 07:54:45 +0200 |
| commit | 4c1145144c94371a589feb3e4e42b2436ac58dc7 (patch) | |
| tree | ee54226b6471704136db3006c46133d9e81c6793 /drivers/base | |
| parent | 54a11ce4ff2a01fc2a231c546a864883633d2b97 (diff) | |
| download | linux-4c1145144c94371a589feb3e4e42b2436ac58dc7.tar.gz linux-4c1145144c94371a589feb3e4e42b2436ac58dc7.tar.bz2 linux-4c1145144c94371a589feb3e4e42b2436ac58dc7.zip | |
regmap: spi: Fix potential off-by-one when calculating reserved size
[ Upstream commit d4ea1d504d2701ba04412f98dc00d45a104c52ab ]
If we ever meet a hardware that uses weird register bits and padding,
we may end up in off-by-one error since x/8 + y/8 might not be equal
to (x + y)/8 in some cases.
bits pad x/8+y/8 (x+y)/8
4..7 0..3 0 0 // x + y from 4 up to 7
4..7 4..7 0 1 // x + y from 8 up to 11
4..7 8..11 1 1 // x + y from 12 up to 15
8..15 0..7 1 1 // x + y from 8 up to 15
8..15 8..15 2 2 // x + y from 16 up to 23
Fix this by using (x+y)/8.
Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://msgid.link/r/20240605205315.19132-1-andy.shevchenko@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/base')
| -rw-r--r-- | drivers/base/regmap/regmap-spi.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/base/regmap/regmap-spi.c b/drivers/base/regmap/regmap-spi.c index 37ab23a9d034..7f14c5ed1e22 100644 --- a/drivers/base/regmap/regmap-spi.c +++ b/drivers/base/regmap/regmap-spi.c @@ -122,8 +122,7 @@ static const struct regmap_bus *regmap_get_spi_bus(struct spi_device *spi, return ERR_PTR(-ENOMEM); max_msg_size = spi_max_message_size(spi); - reg_reserve_size = config->reg_bits / BITS_PER_BYTE - + config->pad_bits / BITS_PER_BYTE; + reg_reserve_size = (config->reg_bits + config->pad_bits) / BITS_PER_BYTE; if (max_size + reg_reserve_size > max_msg_size) max_size -= reg_reserve_size; |