Re: [PATCH] can: mcp251xfd: mcp251xfd_register_get_dev_id(): use correct length to read dev_id

[Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>]

On Thu, Jun 16, 2022 at 11:49:14AM +0200, Marc Kleine-Budde wrote:
> The device ID register is 32 bits wide. The driver uses incorrectly
> the size of a pointer to a u32 to calculate the length of the SPI
> transfer. This results in a read of 2 registers on 64 bit platforms.
> This is no problem on the Linux side, as the RX buffer of the SPI
> transfer is large enough. In the mpc251xfd chip this results in the
> read of an undocumented register. So far no problems were observed.
> 
> This patch fixes the length of the SPI transfer to read the device ID
> register only.
> 
> Fixes: 55e5b97f003e ("can: mcp25xxfd: add driver for Microchip MCP25xxFD SPI CAN")
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>

Thanks,
Mani

> ---
>  drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
> index 34b160024ce3..3160881e89d9 100644
> --- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
> +++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
> @@ -1778,7 +1778,7 @@ mcp251xfd_register_get_dev_id(const struct mcp251xfd_priv *priv, u32 *dev_id,
>  	xfer[0].len = sizeof(buf_tx->cmd);
>  	xfer[0].speed_hz = priv->spi_max_speed_hz_slow;
>  	xfer[1].rx_buf = buf_rx->data;
> -	xfer[1].len = sizeof(dev_id);
> +	xfer[1].len = sizeof(*dev_id);
>  	xfer[1].speed_hz = priv->spi_max_speed_hz_fast;
>  
>  	mcp251xfd_spi_cmd_read_nocrc(&buf_tx->cmd, MCP251XFD_REG_DEVID);
> -- 
> 2.35.1
> 
> 

-- 
மணிவண்ணன் சதாசிவம்