• R
    nvmem: eeprom: at25: fix FRAM byte_len · 9a626577
    Ralph Siemsen 提交于
    Commit fd307a4a ("nvmem: prepare basics for FRAM support") added
    support for FRAM devices such as the Cypress FM25V. During testing, it
    was found that the FRAM detects properly, however reads and writes fail.
    Upon further investigation, two problem were found in at25_probe() routine.
    
    1) In the case of an FRAM device without platform data, eg.
           fram == true && spi->dev.platform_data == NULL
    the stack local variable "struct spi_eeprom chip" is not initialized
    fully, prior to being copied into at25->chip. The chip.flags field in
    particular can cause problems.
    
    2) The byte_len of FRAM is computed from its ID register, and is stored
    into the stack local "struct spi_eeprom chip" structure. This happens
    after the same structure has been copied into at25->chip. As a result,
    at25->chip.byte_len does not contain the correct length of the device.
    In turn this can cause checks at beginning of at25_ee_read() to fail
    (or equally, it could allow reads beyond the end of the device length).
    
    Fix both of these issues by eliminating the on-stack struct spi_eeprom.
    Instead use the one inside at25_data structure, which starts of zeroed.
    
    Fixes: fd307a4a ("nvmem: prepare basics for FRAM support")
    Cc: stable <stable@vger.kernel.org>
    Reviewed-by: NArnd Bergmann <arnd@arndb.de>
    Signed-off-by: NRalph Siemsen <ralph.siemsen@linaro.org>
    Link: https://lore.kernel.org/r/20211108181627.645638-1-ralph.siemsen@linaro.orgSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    9a626577
at25.c 12.6 KB