[PATCH v1 0/1] fsi: cfam: clamp chunk length to remaining count

[PATCH v1 0/1] fsi: cfam: clamp chunk length to remaining count

[Chaitanya Mishra]

This series fixes cfam read/write chunk sizing to respect the remaining
count, preventing over-copy past the user buffer when the request is not
4-byte aligned.

Testing:
- AWS EC2 t3.large, Ubuntu 22.04 (jammy)
- defconfig + OF + FSI, W=1 build of drivers/fsi/fsi-core.o

Commands:
  make defconfig
  scripts/config -e OF
  scripts/config -e FSI
  make olddefconfig
  make -j$(nproc) W=1 drivers/fsi/fsi-core.o

Log (tail):
  UPD     include/generated/timeconst.h
  CC      kernel/bounds.s
  CHKSHA1 include/linux/atomic/atomic-arch-fallback.h
  CHKSHA1 include/linux/atomic/atomic-instrumented.h
  CHKSHA1 include/linux/atomic/atomic-long.h
  UPD     include/generated/bounds.h
  CC      arch/x86/kernel/asm-offsets.s
  UPD     include/generated/asm-offsets.h
  CC      kernel/sched/rq-offsets.s
  CC      /home/ubuntu/linux/tools/objtool/builtin-check.o
  UPD     include/generated/rq-offsets.h
  CALL    scripts/checksyscalls.sh
  CC      /home/ubuntu/linux/tools/objtool/elf.o
  CC      /home/ubuntu/linux/tools/objtool/objtool.o
  CC      /home/ubuntu/linux/tools/objtool/orc_gen.o
  CC      /home/ubuntu/linux/tools/objtool/orc_dump.o
  CC      /home/ubuntu/linux/tools/objtool/libstring.o
  CC      /home/ubuntu/linux/tools/objtool/libctype.o
  CC      /home/ubuntu/linux/tools/objtool/str_error_r.o
  CC      /home/ubuntu/linux/tools/objtool/librbtree.o
  CC      /home/ubuntu/linux/tools/objtool/signal.o
  LD      /home/ubuntu/linux/tools/objtool/objtool-in.o
  LINK    /home/ubuntu/linux/tools/objtool/objtool
  CC      drivers/fsi/fsi-core.o

Chaitanya Mishra (1):
  fsi: cfam: clamp chunk length to remaining count

 drivers/fsi/fsi-core.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

-- 
2.50.1 (Apple Git-155)

[PATCH v1 1/1] fsi: cfam: clamp chunk length to remaining count

[Chaitanya Mishra]

cfam_{read,write} split requests into up to 4-byte aligned chunks.
The per-iteration length is computed from the full count and the
current alignment. Once total_len advances, this can exceed the
remaining bytes, leading to copy_{to,from}_user() touching bytes past
the user buffer and advancing the file offset too far.

Clamp each chunk to the minimum of the alignment-based length and the
remaining bytes so each iteration handles only the bytes left.

Fixes: d1dcd6782576 ("fsi: Add cfam char devices")
Signed-off-by: Chaitanya Mishra <chaitanyamishra.ai@gmail.com>
---
 drivers/fsi/fsi-core.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c
index c6c115993ebc..8a2a02df52ac 100644
--- a/drivers/fsi/fsi-core.c
+++ b/drivers/fsi/fsi-core.c
@@ -674,8 +674,7 @@ static ssize_t cfam_read(struct file *filep, char __user *buf, size_t count,
 	for (total_len = 0; total_len < count; total_len += read_len) {
 		__be32 data;
 
-		read_len = min_t(size_t, count, 4);
-		read_len -= off & 0x3;
+		read_len = min_t(size_t, 4 - (off & 0x3), count - total_len);
 
 		rc = fsi_slave_read(slave, off, &data, read_len);
 		if (rc)
@@ -711,8 +710,7 @@ static ssize_t cfam_write(struct file *filep, const char __user *buf,
 	for (total_len = 0; total_len < count; total_len += write_len) {
 		__be32 data;
 
-		write_len = min_t(size_t, count, 4);
-		write_len -= off & 0x3;
+		write_len = min_t(size_t, 4 - (off & 0x3), count - total_len);
 
 		rc = copy_from_user(&data, buf + total_len, write_len);
 		if (rc) {
-- 
2.50.1 (Apple Git-155)