[lvc-project] [PATCH 6.1.y] spi-rockchip: Fix register out of bounds access

[Vasiliy Kovalev]

From: Luis de Arquer <luis.dearquer at inertim.com>

commit 7a874e8b54ea21094f7fd2d428b164394c6cb316 upstream.

Do not write native chip select stuff for GPIO chip selects.
GPIOs can be numbered much higher than native CS.
Also, it makes no sense.

Fixes: 736b81e07517 ("spi: rockchip: Support SPI_CS_HIGH")
Signed-off-by: Luis de Arquer <luis.dearquer at inertim.com>
Link: https://patch.msgid.link/365ccddfba110549202b3520f4401a6a936e82a8.camel@gmail.com
Signed-off-by: Mark Brown <broonie at kernel.org>
[ kovalev: bp to fix CVE-2025-38081; added Fixes tag ]
Signed-off-by: Vasiliy Kovalev <kovalev at altlinux.org>
---
 drivers/spi/spi-rockchip.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
index dbefc7e77313..cba858a7b4f9 100644
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -540,8 +540,8 @@ static int rockchip_spi_config(struct rockchip_spi *rs,
 	cr0 |= (spi->mode & 0x3U) << CR0_SCPH_OFFSET;
 	if (spi->mode & SPI_LSB_FIRST)
 		cr0 |= CR0_FBM_LSB << CR0_FBM_OFFSET;
-	if (spi->mode & SPI_CS_HIGH)
-		cr0 |= BIT(spi->chip_select) << CR0_SOI_OFFSET;
+	if ((spi->mode & SPI_CS_HIGH) && !(spi_get_csgpiod(spi, 0)))
+		cr0 |= BIT(spi_get_chipselect(spi, 0)) << CR0_SOI_OFFSET;
 
 	if (xfer->rx_buf && xfer->tx_buf)
 		cr0 |= CR0_XFM_TR << CR0_XFM_OFFSET;
-- 
2.50.1