Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

spi: sc18is602: don't consider the chip select byte in sc18is602_check_transfer

For each spi_message, the sc18is602 I2C-to-SPI bridge driver checks the
length of each spi_transfer against 200 (the size of the chip's internal
buffer) minus hw->tlen (the number of bytes transferred so far).

The first byte of the transferred data is the Function ID (the SPI
slave's chip select) and as per the documentation of the chip:
https://www.nxp.com/docs/en/data-sheet/SC18IS602B.pdf
the data buffer is up to 200 bytes deep _without_ accounting for the
Function ID byte.

However, in sc18is602_txrx(), the driver keeps the Function ID as part
of the buffer, and increments hw->tlen from 0 to 1. Combined with the
check in sc18is602_check_transfer, this prevents us from issuing a
transfer that has exactly 200 bytes in size, but only 199.

Adjust the check function to reflect that the Function ID is not part of
the 200 byte deep data buffer.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://lore.kernel.org/r/20210520131238.2903024-2-olteanv@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>

authored by

Vladimir Oltean and committed by
Mark Brown
bda7db1d c37fe6af

+1 -1
+1 -1
drivers/spi/spi-sc18is602.c
··· 174 174 static int sc18is602_check_transfer(struct spi_device *spi, 175 175 struct spi_transfer *t, int tlen) 176 176 { 177 - if (t && t->len + tlen > SC18IS602_BUFSIZ) 177 + if (t && t->len + tlen > SC18IS602_BUFSIZ + 1) 178 178 return -EINVAL; 179 179 180 180 return 0;