From: Wentao Guan vsc_tp_xfer() computes the packet CRC over sizeof(pkt) + olen bytes, but pkt is a pointer, so sizeof(pkt) evaluates to the pointer size instead of the size of struct vsc_tp_packet_hdr. The value correctly match the 8-byte header on 64-bit builds. Use sizeof(pkt->hdr), consistent with the header size used everywhere else in the driver, e.g. in VSC_TP_PACKET_SIZE(). Cc: stable@vger.kernel.org Fixes: 566f5ca97680 ("mei: Add transport driver for IVSC device") Reviewed-by: Sakari Ailus Signed-off-by: Wentao Guan Signed-off-by: Alexander Usyskin --- drivers/misc/mei/vsc-tp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/mei/vsc-tp.c b/drivers/misc/mei/vsc-tp.c index 432bc59f11f9..ce877cb95757 100644 --- a/drivers/misc/mei/vsc-tp.c +++ b/drivers/misc/mei/vsc-tp.c @@ -293,7 +293,7 @@ int vsc_tp_xfer(struct vsc_tp *tp, u8 cmd, const void *obuf, size_t olen, pkt->hdr.seq = cpu_to_le32(++tp->seq); memcpy(pkt->buf, obuf, olen); - crc = ~crc32(~0, (u8 *)pkt, sizeof(pkt) + olen); + crc = ~crc32(~0, (u8 *)pkt, sizeof(pkt->hdr) + olen); memcpy(pkt->buf + olen, &crc, sizeof(crc)); ret = vsc_tp_wakeup_request(tp); --- base-commit: cee9395acd8043be0644b25c34bfa86623f2b935 change-id: 20261006-vcs_fix_crc-d2bc03a64163 Best regards, -- Alexander Usyskin