[PATCH] spi: amd: validate FIFO usage before executing message

[Weibin Liu <liuwb@xiaopeng.com>]

The RX FIFO bound is checked in the drain loop, after
amd_spi_execute_opcode(). A message whose cumulative RX length exceeds
AMD_SPI_FIFO_SIZE can therefore issue an SPI transaction before being
rejected.

Check tx_len + rx_len while walking the message and drop the drain-loop
check. This validates the complete message before executing the command.

Tested with a user-space replica covering TX, RX and mixed messages at
the 70/71-byte boundary. Oversized split-RX messages are now rejected
without executing the command. No AMD SPI hardware was available.

Assisted-by: LLM
Suggested-by: Krishnamoorthi M <krishnamoorthi.m@amd.com>
Fixes: e2f4edfc061e ("spi: amd: fix len==0 underflow and FIFO overflow")
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Weibin Liu <liuwb@xiaopeng.com>
---
 drivers/spi/spi-amd.c | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/drivers/spi/spi-amd.c b/drivers/spi/spi-amd.c
index ddf89e5353c5..d3953de255be 100644
--- a/drivers/spi/spi-amd.c
+++ b/drivers/spi/spi-amd.c
@@ -331,13 +331,6 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
 		else
 			amd_set_spi_freq(amd_spi, spi->max_speed_hz);
 
-		/* Reject transfers that would overflow the FIFO window */
-		if (fifo_pos + xfer->len >
-		    AMD_SPI_FIFO_BASE + AMD_SPI_FIFO_SIZE) {
-			message->status = -EMSGSIZE;
-			goto fin_msg;
-		}
-
 		if (xfer->tx_buf) {
 			buf = (u8 *)xfer->tx_buf;
 			if (!tx_len) {
@@ -346,6 +339,10 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
 				xfer->len--;
 			}
 			tx_len += xfer->len;
+			if (tx_len + rx_len > AMD_SPI_FIFO_SIZE) {
+				message->status = -EMSGSIZE;
+				goto fin_msg;
+			}
 
 			/* Write data into the FIFO. */
 			for (i = 0; i < xfer->len; i++)
@@ -355,8 +352,13 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
 		}
 
 		/* Store no. of bytes to be received from FIFO */
-		if (xfer->rx_buf)
+		if (xfer->rx_buf) {
 			rx_len += xfer->len;
+			if (tx_len + rx_len > AMD_SPI_FIFO_SIZE) {
+				message->status = -EMSGSIZE;
+				goto fin_msg;
+			}
+		}
 	}
 
 	if (!buf) {
@@ -380,12 +382,6 @@ static inline int amd_spi_fifo_xfer(struct amd_spi *amd_spi,
 
 		list_for_each_entry(xfer, &message->transfers, transfer_list)
 			if (xfer->rx_buf) {
-				/* Reject transfers that would overflow the FIFO window */
-				if (fifo_pos + xfer->len >
-				    AMD_SPI_FIFO_BASE + AMD_SPI_FIFO_SIZE) {
-					message->status = -EMSGSIZE;
-					goto fin_msg;
-				}
 				buf = (u8 *)xfer->rx_buf;
 				/* Read data from FIFO to receive buffer */
 				for (i = 0; i < xfer->len; i++)

base-commit: dc5ca34f5e8dc10c566ef39aa3b1a201a17ca734
-- 
2.50.1