From 6093f744fec77e06f98b0267ced88b9caa64eae8 Mon Sep 17 00:00:00 2001 From: Marc Kleine-Budde Date: Fri, 16 Aug 2019 10:44:49 +0200 Subject: [PATCH] can: tcan4x5x: fix data length in regmap write path In regmap_spi_gather_write() the "addr" is prepared. The chip expects the number of 32 bit words to write in the lower 8 bits of addr. However the number of byte to write in shifted left by 3 (== divided by 8). The function tcan4x5x_regmap_write() is called with a data buffer, which holds the register information in the first 32 bits, followed by the actual data. tcan4x5x_regmap_write() calls regmap_spi_gather_write() with the val pointer pointing to the actual data (i.e. the original pointer is incremented by 4 bytes), but without decrementing the count. If the regmap framework only calls tcan4x5x_regmap_write() to read single 32 bit registers these two bugs cancel each other. This patch fixes the code. Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel") Signed-off-by: Marc Kleine-Budde --- drivers/net/can/m_can/tcan4x5x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c index 7a73a4cfc1bb..a697996d81b4 100644 --- a/drivers/net/can/m_can/tcan4x5x.c +++ b/drivers/net/can/m_can/tcan4x5x.c @@ -178,7 +178,7 @@ static int regmap_spi_gather_write(void *context, const void *reg, { .tx_buf = val, .len = val_len, }, }; - addr = TCAN4X5X_WRITE_CMD | (*((u16 *)reg) << 8) | val_len >> 3; + addr = TCAN4X5X_WRITE_CMD | (*((u16 *)reg) << 8) | val_len >> 2; spi_message_init(&m); spi_message_add_tail(&t[0], &m); @@ -192,7 +192,7 @@ static int tcan4x5x_regmap_write(void *context, const void *data, size_t count) u16 *reg = (u16 *)(data); const u32 *val = data + 4; - return regmap_spi_gather_write(context, reg, 4, val, count); + return regmap_spi_gather_write(context, reg, 4, val, count - 4); } static int regmap_spi_async_write(void *context, -- 2.11.0