From b106776080a1cf953a1b2fd50cb2a995db4732be Mon Sep 17 00:00:00 2001

From: Mathias Nyman <mathias.nyman@linux.intel.com>

Date: Tue, 27 Apr 2021 15:48:29 +0300

Subject: [PATCH] thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue

Git-commit: b106776080a1cf953a1b2fd50cb2a995db4732be

Patch-mainline: v5.13-rc4

References: git-fixes

Up to 64 bytes of data can be read from NVM in one go. Read address

must be dword aligned. Data is read into a local buffer.

If caller asks to read data starting at an unaligned address then full

dword is anyway read from NVM into a local buffer. Data is then copied

from the local buffer starting at the unaligned offset to the caller

buffer.

In cases where asked data length + unaligned offset is over 64 bytes

we need to make sure we don't read past the 64 bytes in the local

buffer when copying to caller buffer, and make sure that we don't

skip copying unaligned offset bytes from local buffer anymore after

the first round of 64 byte NVM data read.

Fixes: 3e13676862f9 ("thunderbolt: Add support for DMA configuration based mailbox")

Cc: stable@vger.kernel.org

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>

Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>

Acked-by: Takashi Iwai <tiwai@suse.de>

---

 drivers/thunderbolt/dma_port.c | 11 ++++++-----

 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/thunderbolt/dma_port.c b/drivers/thunderbolt/dma_port.c

index 7288aaf01ae6..5631319f7b20 100644

--- a/drivers/thunderbolt/dma_port.c

+++ b/drivers/thunderbolt/dma_port.c

@@ -366,15 +366,15 @@ int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address,

 			void *buf, size_t size)

 {

 	unsigned int retries = DMA_PORT_RETRIES;

-	unsigned int offset;

-

-	offset = address & 3;

-	address = address & ~3;

 	do {

-		u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4);

+		unsigned int offset;

+		size_t nbytes;

 		int ret;

+		offset = address & 3;

+		nbytes = min_t(size_t, size + offset, MAIL_DATA_DWORDS * 4);

+

 		ret = dma_port_flash_read_block(dma, address, dma->buf,

 						ALIGN(nbytes, 4));

 		if (ret) {

@@ -386,6 +386,7 @@ int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address,

 			return ret;

 		}

+		nbytes -= offset;

 		memcpy(buf, dma->buf + offset, nbytes);

 		size -= nbytes;

-- 

2.26.2