Commit 52eb6786 authored by Ayush Singh's avatar Ayush Singh Committed by Greg Kroah-Hartman
Browse files

greybus: gb-beagleplay: Ensure le for values in transport 



Ensure that the following values are little-endian:
- header->pad (which is used for cport_id)
- header->size

Fixes: ec558bbf ("greybus: Add BeaglePlay Linux Driver")
Reported-by: default avatarkernel test robot <yujie.liu@intel.com>
Closes: https://lore.kernel.org/r/202311072329.Xogj7hGW-lkp@intel.com/


Signed-off-by: default avatarAyush Singh <ayushdevel1325@gmail.com>
Link: https://lore.kernel.org/r/20231203075312.255233-1-ayushdevel1325@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4181ef7d

drivers/greybus/gb-beagleplay.c

+5 −4
Original line number Diff line number Diff line
@@ -93,9 +93,9 @@ static void hdlc_rx_greybus_frame(struct gb_beagleplay *bg, u8 *buf, u16 len) 
	memcpy(&cport_id, hdr->pad, sizeof(cport_id));



	dev_dbg(&bg->sd->dev, "Greybus Operation %u type %X cport %u status %u received",

		hdr->operation_id, hdr->type, cport_id, hdr->result);

		hdr->operation_id, hdr->type, le16_to_cpu(cport_id), hdr->result);



	greybus_data_rcvd(bg->gb_hd, cport_id, buf, len);

	greybus_data_rcvd(bg->gb_hd, le16_to_cpu(cport_id), buf, len);

}



static void hdlc_rx_dbg_frame(const struct gb_beagleplay *bg, const char *buf, u16 len)
@@ -340,14 +340,15 @@ static int gb_message_send(struct gb_host_device *hd, u16 cport, struct gb_messa 
{

	struct gb_beagleplay *bg = dev_get_drvdata(&hd->dev);

	struct hdlc_payload payloads[2];

	__le16 cport_id = le16_to_cpu(cport);



	dev_dbg(&hd->dev, "Sending greybus message with Operation %u, Type: %X on Cport %u",

		msg->header->operation_id, msg->header->type, cport);



	if (msg->header->size > RX_HDLC_PAYLOAD)

	if (le16_to_cpu(msg->header->size) > RX_HDLC_PAYLOAD)

		return dev_err_probe(&hd->dev, -E2BIG, "Greybus message too big");



	memcpy(msg->header->pad, &cport, sizeof(cport));

	memcpy(msg->header->pad, &cport_id, sizeof(cport_id));



	payloads[0].buf = msg->header;

	payloads[0].len = sizeof(*msg->header);