diff options
| author | Mark Brown <broonie@kernel.org> | 2025-06-30 12:42:36 +0100 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2025-06-30 12:42:36 +0100 |
| commit | 4ec24e9601d5cfc9ac9798c0acb8e88c6ab61fc5 (patch) | |
| tree | 356d3a2c38c739da3a0347a57db7bf90b6e57e8d /include/linux | |
| parent | fa60c094c19b97e103d653f528f8d9c178b6a5f5 (diff) | |
| parent | ddaad4ad774d4ae02047ef873a8e38f62a4b7b01 (diff) | |
spi: spi-qpic-snand: avoid memory corruption
Merge series from Gabor Juhos <j4g8y7@gmail.com>:
The 'spi-qpic-nand' driver may cause memory corruption under some
circumstances. The first patch in the series changes the driver to
avoid that, whereas the second adds some sanity checks to the common
QPIC code in order to make detecting such errors easier in the future.
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/mtd/nand-qpic-common.h | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/include/linux/mtd/nand-qpic-common.h b/include/linux/mtd/nand-qpic-common.h index e8462deda6db..f0aa098a395f 100644 --- a/include/linux/mtd/nand-qpic-common.h +++ b/include/linux/mtd/nand-qpic-common.h @@ -237,6 +237,9 @@ * @last_data_desc - last DMA desc in data channel (tx/rx). * @last_cmd_desc - last DMA desc in command channel. * @txn_done - completion for NAND transfer. + * @bam_ce_nitems - the number of elements in the @bam_ce array + * @cmd_sgl_nitems - the number of elements in the @cmd_sgl array + * @data_sgl_nitems - the number of elements in the @data_sgl array * @bam_ce_pos - the index in bam_ce which is available for next sgl * @bam_ce_start - the index in bam_ce which marks the start position ce * for current sgl. It will be used for size calculation @@ -255,6 +258,11 @@ struct bam_transaction { struct dma_async_tx_descriptor *last_data_desc; struct dma_async_tx_descriptor *last_cmd_desc; struct completion txn_done; + + unsigned int bam_ce_nitems; + unsigned int cmd_sgl_nitems; + unsigned int data_sgl_nitems; + struct_group(bam_positions, u32 bam_ce_pos; u32 bam_ce_start; |