lkml.org 
[lkml]   [2021]   [May]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 041/177] thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
    Date
    From: Mathias Nyman <mathias.nyman@linux.intel.com>

    commit b106776080a1cf953a1b2fd50cb2a995db4732be upstream.

    Up to 64 bytes of data can be read from NVM in one go. Read address
    must be dword aligned. Data is read into a local buffer.

    If caller asks to read data starting at an unaligned address then full
    dword is anyway read from NVM into a local buffer. Data is then copied
    from the local buffer starting at the unaligned offset to the caller
    buffer.

    In cases where asked data length + unaligned offset is over 64 bytes
    we need to make sure we don't read past the 64 bytes in the local
    buffer when copying to caller buffer, and make sure that we don't
    skip copying unaligned offset bytes from local buffer anymore after
    the first round of 64 byte NVM data read.

    Fixes: 3e13676862f9 ("thunderbolt: Add support for DMA configuration based mailbox")
    Cc: stable@vger.kernel.org
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/thunderbolt/dma_port.c | 11 ++++++-----
    1 file changed, 6 insertions(+), 5 deletions(-)

    --- a/drivers/thunderbolt/dma_port.c
    +++ b/drivers/thunderbolt/dma_port.c
    @@ -364,15 +364,15 @@ int dma_port_flash_read(struct tb_dma_po
    void *buf, size_t size)
    {
    unsigned int retries = DMA_PORT_RETRIES;
    - unsigned int offset;
    -
    - offset = address & 3;
    - address = address & ~3;

    do {
    - u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4);
    + unsigned int offset;
    + size_t nbytes;
    int ret;

    + offset = address & 3;
    + nbytes = min_t(size_t, size + offset, MAIL_DATA_DWORDS * 4);
    +
    ret = dma_port_flash_read_block(dma, address, dma->buf,
    ALIGN(nbytes, 4));
    if (ret) {
    @@ -384,6 +384,7 @@ int dma_port_flash_read(struct tb_dma_po
    return ret;
    }

    + nbytes -= offset;
    memcpy(buf, dma->buf + offset, nbytes);

    size -= nbytes;

    \
     
     \ /
      Last update: 2021-05-31 17:20    [W:5.178 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site