[PATCH] spi: topcliff-pch: clamp DMA bpw_len by bytes not words

[Weibin Liu]

pch_spi_handle_dma() computes data->bpw_len as a word count
(cur_trans->len / (bpw / 8)) and then clamps it to PCH_BUF_SIZE.
The DMA coherent buffers tx_buf_virt/rx_buf_virt are allocated by
pch_alloc_dma_buf() with dma_alloc_coherent(..., PCH_BUF_SIZE, ...),
i.e. PCH_BUF_SIZE bytes.

With bits_per_word = 16 the copy loops handle bpw_len u16 elements,
so up to PCH_BUF_SIZE * 2 bytes are written into the PCH_BUF_SIZE
byte tx_buf_virt and read back from rx_buf_virt, overflowing the
coherent allocations by up to PCH_BUF_SIZE bytes.

Clamp bpw_len to PCH_BUF_SIZE / (bpw / 8) words and subtract the
corresponding byte count from cur_trans->len so the remaining
transfer length stays consistent.

Reproduced with a user-space replica of the length arithmetic: with
bits_per_word = 16 and len = 8192, bpw_len = 4096 words pass the
existing clamp and the copy loop addresses 8192 bytes of the
4096-byte buffer; with the clamp it addresses exactly 4096. No EG20T
platform hardware was available.

Reviewed-by: Liu Chao <liuc63@xxxxxxxxxxxx>
Fixes: 7d05b3e868ee0f ("spi-topcliff-pch: Fix issue for transmitting over 4KByte")
Cc: stable@xxxxxxxxxxxxxxx # 3.4+
Signed-off-by: Weibin Liu <liuwb@xxxxxxxxxxxx>
---
 drivers/spi/spi-topcliff-pch.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index 98723042c16f..1603a5f1e00b 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -934,9 +934,10 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
 	}
 	data->bpw_len = data->cur_trans->len / (*bpw / 8);
 
-	if (data->bpw_len > PCH_BUF_SIZE) {
-		data->bpw_len = PCH_BUF_SIZE;
-		data->cur_trans->len -= PCH_BUF_SIZE;
+	/* DMA buffers are PCH_BUF_SIZE bytes, bpw_len is in words */
+	if (data->bpw_len > PCH_BUF_SIZE / (*bpw / 8)) {
+		data->bpw_len = PCH_BUF_SIZE / (*bpw / 8);
+		data->cur_trans->len -= data->bpw_len * (*bpw / 8);
 	}
 
 	/* copy Tx Data */

---
base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
change-id: 20261014-spi-pch-bpw-clamp-7c24ba25702a

Best regards,
-- 
Weibin Liu <liuwb@xxxxxxxxxxxx>