sprd_pmic_spi_read() passes 1 as the transfer length to spi_read(), but the length parameter is a byte count, and the ADI controller consumes a u32 register address from the buffer. The ADI driver ignores the transfer length and always operates on the first u32, so this happens to work with the 8-byte stack buffer, but the advertised length does not describe what the controller actually accesses. Pass sizeof(u32) so the length matches the bytes touched by the controller. The companion patch to the ADI driver rejects lengths that do not exactly match the ADI register access size. Tested in QEMU (aarch64 virt) together with the companion patch: the SC27xx driver's register transfers still pass the new length checks once it advertises the byte length. Fixes: 25ca4ae43466 ("mfd: Add Spreadtrum SC27xx series PMICs driver") Cc: stable@vger.kernel.org # 4.15+ Signed-off-by: Weibin Liu Reviewed-by: Guanglei Zhu --- drivers/mfd/sprd-sc27xx-spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mfd/sprd-sc27xx-spi.c b/drivers/mfd/sprd-sc27xx-spi.c index 9a8e6add8fca..8759cee052b0 100644 --- a/drivers/mfd/sprd-sc27xx-spi.c +++ b/drivers/mfd/sprd-sc27xx-spi.c @@ -156,7 +156,7 @@ static int sprd_pmic_spi_read(void *context, /* Copy address to read from into first element of SPI buffer. */ memcpy(rx_buf, reg, sizeof(u32)); - ret = spi_read(spi, rx_buf, 1); + ret = spi_read(spi, rx_buf, sizeof(u32)); if (ret < 0) return ret; -- 2.50.1