From 7b8164c1a29ce8ef91672c50ceac5c14475f5601 Mon Sep 17 00:00:00 2001 From: Curtis Malainey Date: Thu, 16 May 2019 18:43:40 -0700 Subject: [PATCH] ASoC: rt5677-spi: Handle over reading when flipping bytes There is a case when a we want to read a large number of bytes that require a burst but is not a multiple of the word size (8). When this happens rt5677_spi_reverse will run off the end of the buffer. The solution is to tell spi_reverse the actual size of the destination and stop if we reach it even if we have data left that we read. Cc: Ben Zhang Signed-off-by: Curtis Malainey Signed-off-by: Mark Brown --- sound/soc/codecs/rt5677-spi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sound/soc/codecs/rt5677-spi.c b/sound/soc/codecs/rt5677-spi.c index 84b6bd8b50e1..a4dfa0345c6e 100644 --- a/sound/soc/codecs/rt5677-spi.c +++ b/sound/soc/codecs/rt5677-spi.c @@ -101,7 +101,7 @@ static void rt5677_spi_reverse(u8 *dst, u32 dstlen, const u8 *src, u32 srclen) u32 word_size = min_t(u32, dstlen, 8); for (w = 0; w < dstlen; w += word_size) { - for (i = 0; i < word_size; i++) { + for (i = 0; i < word_size && i + w < dstlen; i++) { si = w + word_size - i - 1; dst[w + i] = si < srclen ? src[si] : 0; } @@ -152,8 +152,9 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len) status |= spi_sync(g_spi, &m); mutex_unlock(&spi_mutex); + /* Copy data back to caller buffer */ - rt5677_spi_reverse(cb + offset, t[1].len, body, t[1].len); + rt5677_spi_reverse(cb + offset, len - offset, body, t[1].len); } return status; } -- 2.11.0