diff mbox series

[2/4] thunderbolt: usb4: Fix NVM read buffer bounds and offset issue

Message ID 20210517115907.52503-3-mika.westerberg@linux.intel.com (mailing list archive)
State New, archived
Headers show
Series thunderbolt: NVM fixes and consolidation | expand

Commit Message

Mika Westerberg May 17, 2021, 11:59 a.m. UTC 
From: Mathias Nyman <mathias.nyman@linux.intel.com>

Up to 64 bytes of data can be read from NVM in one go.
Read address must be dword aligned. Data is read into a local buffer.

If caller asks to read data starting at an unaligned address then full
dword is anyway read from NVM into a local buffer. Data is then copied
from the local buffer starting at the unaligned offset to the caller
buffer.

In cases where asked data length + unaligned offset is over 64 bytes
we need to make sure we don't read past the 64 bytes in the local
buffer when copying to caller buffer, and make sure that we don't
skip copying unaligned offset bytes from local buffer anymore after
the first round of 64 byte NVM data read.

Fixes: b04079837b20 ("thunderbolt: Add initial support for USB4")
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
---
 drivers/thunderbolt/usb4.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Comments

Mika Westerberg May 20, 2021, 8:54 a.m. UTC | #1 
On Mon, May 17, 2021 at 02:59:05PM +0300, Mika Westerberg wrote:
> From: Mathias Nyman <mathias.nyman@linux.intel.com>
> 
> Up to 64 bytes of data can be read from NVM in one go.
> Read address must be dword aligned. Data is read into a local buffer.
> 
> If caller asks to read data starting at an unaligned address then full
> dword is anyway read from NVM into a local buffer. Data is then copied
> from the local buffer starting at the unaligned offset to the caller
> buffer.
> 
> In cases where asked data length + unaligned offset is over 64 bytes
> we need to make sure we don't read past the 64 bytes in the local
> buffer when copying to caller buffer, and make sure that we don't
> skip copying unaligned offset bytes from local buffer anymore after
> the first round of 64 byte NVM data read.
> 
> Fixes: b04079837b20 ("thunderbolt: Add initial support for USB4")
> Cc: stable@vger.kernel.org
> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>

Applied to thunderbolt.git/fixes.
diff mbox series

Patch

diff --git a/drivers/thunderbolt/usb4.c b/drivers/thunderbolt/usb4.c
index 680bc738dd66..671d72af8ba1 100644
--- a/drivers/thunderbolt/usb4.c
+++ b/drivers/thunderbolt/usb4.c
@@ -68,15 +68,15 @@  static int usb4_do_read_data(u16 address, void *buf, size_t size,
 	unsigned int retries = USB4_DATA_RETRIES;
 	unsigned int offset;
 
-	offset = address & 3;
-	address = address & ~3;
-
 	do {
-		size_t nbytes = min_t(size_t, size, USB4_DATA_DWORDS * 4);
 		unsigned int dwaddress, dwords;
 		u8 data[USB4_DATA_DWORDS * 4];
+		size_t nbytes;
 		int ret;
 
+		offset = address & 3;
+		nbytes = min_t(size_t, size + offset, USB4_DATA_DWORDS * 4);
+
 		dwaddress = address / 4;
 		dwords = ALIGN(nbytes, 4) / 4;
 
@@ -87,6 +87,7 @@  static int usb4_do_read_data(u16 address, void *buf, size_t size,
 			return ret;
 		}
 
+		nbytes -= offset;
 		memcpy(buf, data + offset, nbytes);
 
 		size -= nbytes;