Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Tam Nguyen <tamnguyenchi@os.amperecomputing.com>
To:     linux-kernel@vger.kernel.org, linux-i2c@vger.kernel.org
Cc:     patches@amperecomputing.com, jarkko.nikula@linux.intel.com,
        andriy.shevchenko@linux.intel.com, mika.westerberg@linux.intel.com,
        jsd@semihalf.com, tamnguyenchi@os.amperecomputing.com,
        chuong@os.amperecomputing.com, darren@os.amperecomputing.com,
        Quan Nguyen <quan@os.amperecomputing.com>,
        stable@vger.kernel.org
Subject: [PATCH v2 1/2] i2c: designware: Correct length byte validation logic
Date:   Wed, 26 Jul 2023 15:00:00 +0700
Message-Id: <20230726080001.337353-2-tamnguyenchi@os.amperecomputing.com>
In-Reply-To: <20230726080001.337353-1-tamnguyenchi@os.amperecomputing.com>
References: <20230726080001.337353-1-tamnguyenchi@os.amperecomputing.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?NkKP70Wlryf5Wy/ysnOYiyEaQcWQxLJ7/YzX5Uv6DokiOh2Vu4n1aizf6qul?=
 =?us-ascii?Q?SkyuvIfks0t9RGd017zwOfAbtE9QVj+M377YmpnPr+ogiTC8DbVib6ZFvMzB?=
 =?us-ascii?Q?NxfB/8dkU04P5HPxk9v0vFbx+4MY8c9oZFgdB7zERHn9jsS9MWIpd/oAqooS?=
 =?us-ascii?Q?oUjugiuqIQhz2Igk+m8iDUdUgfNUIl6OEaS4fmgmR4Zy+NzhLMqEzN2TfH2m?=
 =?us-ascii?Q?MLIlWg88CwIm0432bXACpwCtL7jM/dKlfYGHW5B8nts6M4JbZQrWSDOPVofS?=
 =?us-ascii?Q?hTtIZYNt2NtMHxaYsx91IzLjsExXUdWyzpvdVR+12KHibjRIQ7qjyHmUz54G?=
 =?us-ascii?Q?LQ2AuyJYTxnwzx4gtgw83Wd+YQen7VdYlDRISOroV5LZKD79XHzPm5juJqme?=
 =?us-ascii?Q?gAcEzgRLkanSGXMRyHddfsR/nEH3ea40FVnwINAb6uPSbson/LWaVcETN+pJ?=
 =?us-ascii?Q?Z4ndyu3bWjrsOlMh2O/X8qQQhUTALum7k2tlLyemjZlPY6XkFLhIihP7VpN9?=
 =?us-ascii?Q?wFGLQUlcH2PmCwNV/y5Lgz3S+RuyQHX2oxRFsDCFAUOJLawlEn4AXJwgh9+x?=
 =?us-ascii?Q?1JXgK+WY/2KMMjYaTS+bZ46X+61nlRwbGC6ue+M0JnG5DA/4TFZ4d5oe8jy9?=
 =?us-ascii?Q?DPhZl4mgenaOaFzyE1zI5vaPBRBdbPZOLgsyKqXr4KPcMZ88G2yjYfaQI56R?=
 =?us-ascii?Q?QRM3awZFNihEBFfIr1Iw3o0YzT1xPZ/BxhxvLh30hDB8h453WccIMe6pkVss?=
 =?us-ascii?Q?362SUhALI+xS+R8QdHNCPFnJsUwU/yjUALx37Fon5vQEp8DfUayEw/Do+/YS?=
 =?us-ascii?Q?aCDkMo+U88q3Pq5ZVQ5nXmv1eXL9FbtHpcc4eDBc1YLBNwhsw8rAGjatMrXn?=
 =?us-ascii?Q?1CNhBIeMFKA9kCRaHJoyEqMbi/9vPLy4CDoLG8QSPkDkm2cVVsrHeOEf8wmi?=
 =?us-ascii?Q?o1tQsnEVFdyi8RugupA9gUrtgKQkEkJNEqV9eZ08Qa425HkpRWo0/6USbxW1?=
 =?us-ascii?Q?MUAVYYdrS4h+Odbkb99NBiX5UYb4l9CfgNiG2vIFftdKxAw7dXcG/4XfvGr2?=
 =?us-ascii?Q?WbV9r7Vu+f+/k3H95Kjbc2OSw7NiWA68YJzdU2fArOyVX5dZi5NHj72ZHgzg?=
 =?us-ascii?Q?QMEoeBetdnQ0rU8h9uQhK4jd+BLJXfNc5C1hkNs90rJBpPDdxrnLoR/2smOJ?=
 =?us-ascii?Q?YgsEC4LGhznMScnUB/AD90mALiO46SVitWYYhZqG9WKs/yjJOssqr5WOUc6V?=
 =?us-ascii?Q?C65y5Y12KSni2fsdh6sQkfqyb9ImbQVBnhJbn16ZeVpQ+YjLOJ0bOzTgtyO3?=
 =?us-ascii?Q?HFFVPl+MZwbgUtxTJYbH9k8ddfmyO6in+tPZ1oZ3hrHH16bYZp9Wx8GSsWRm?=
 =?us-ascii?Q?x0HMGFsQBe8ayoPUZLKZz9sV/Ge1Yi3R2I7E+p1trKp+pum3fbJBjk9nlAZw?=
 =?us-ascii?Q?M2F1b63Ww9LrcCqF6A2tzANKCxSMncj4z0tT6SwR8g6tLt7WoKCM1CibNsmh?=
 =?us-ascii?Q?wcuGPny3KCwz7kD07mcBrsWoplfChDrfGFiW815A8eO72AXGss9iKftLEFIh?=
 =?us-ascii?Q?gxvKYKJHHhDHcOZC+wR9hnoOQ26lpbI2aS5dnxPjxdZWFtlKGXi/nTfFNYcB?=
 =?us-ascii?Q?Rl3jwq2kC3Fx4KhTHlvq4LxZRLs27rCh20PvfU/w6Skt?=
X-OriginatorOrg: os.amperecomputing.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 0c9fd108-d6a7-46e8-de9a-08db8dae6369
X-MS-Exchange-CrossTenant-AuthSource: SA1PR01MB8131.prod.exchangelabs.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jul 2023 08:00:33.6776
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3bc2b170-fd94-476d-b0ce-4229bdc904a7
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: nmEG/McPC+GQgsrvdZzksRaBkgBt2m1zRNPc7PmFVrbaWcsZBR2ELX6ywJXSH2/KIMxzEcIPhTiwG9ZN9KITpXNDbvx/eSAWzuVX0/lfzU4gFjDWQmrwpqTWDpfn+e9v
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA3PR01MB7988
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,
        SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Quan Nguyen <quan@os.amperecomputing.com>

Commit 0daede80f870 ("i2c: designware: Convert driver to using regmap API")
changes the logic to validate the whole 32-bit return value of
DW_IC_DATA_CMD register instead of 8-bit LSB without reason.

Later, commit f53f15ba5a85 ("i2c: designware: Get right data length"),
introduced partial fix but not enough because the "tmp > 0" still test
tmp as 32-bit value and is wrong in case the IC_DATA_CMD[11] is set.

Revert the logic to just before commit 0daede80f870
("i2c: designware: Convert driver to using regmap API").

Fixes: f53f15ba5a85 ("i2c: designware: Get right data length")
Fixes: 0daede80f870 ("i2c: designware: Convert driver to using regmap API")
Cc: stable@vger.kernel.org
Signed-off-by: Tam Nguyen <tamnguyenchi@os.amperecomputing.com>
Signed-off-by: Quan Nguyen <quan@os.amperecomputing.com>
---
 drivers/i2c/busses/i2c-designware-master.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index 55ea91a63382..e96276d1b002 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -526,9 +526,10 @@ i2c_dw_read(struct dw_i2c_dev *dev)
 			u32 flags = msgs[dev->msg_read_idx].flags;
 
 			regmap_read(dev->map, DW_IC_DATA_CMD, &tmp);
+			tmp &= DW_IC_DATA_CMD_DAT;
 			/* Ensure length byte is a valid value */
 			if (flags & I2C_M_RECV_LEN &&
-			    (tmp & DW_IC_DATA_CMD_DAT) <= I2C_SMBUS_BLOCK_MAX && tmp > 0) {
+			    tmp <= I2C_SMBUS_BLOCK_MAX && tmp > 0) {
 				len = i2c_dw_recv_len(dev, tmp);
 			}
 			*buf++ = tmp;
-- 
2.25.1