RE: [PATCH 1/2] HID: intel-thc-hid: intel-quickspi: size the input buffer for the DMA

[Xu, Even]

> -----Original Message-----
> From: HyeongJun An <sammiee5311@xxxxxxxxx>
> Sent: Thursday, August 20, 2026 7:16 PM
> To: Xu, Even <even.xu@xxxxxxxxx>; Sun, Xinpeng <xinpeng.sun@xxxxxxxxx>; Jiri
> Kosina <jikos@xxxxxxxxxx>; Benjamin Tissoires <bentiss@xxxxxxxxxx>
> Cc: linux-input@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx;
> stable@xxxxxxxxxxxxxxx; HyeongJun An <sammiee5311@xxxxxxxxx>
> Subject: [PATCH 1/2] HID: intel-thc-hid: intel-quickspi: size the input buffer for the
> DMA
> 
> quickspi_alloc_report_buf() sizes input_buf from max_input_len, but the
> RXDMA2 channel it feeds is programmed with ALIGN(max_input_len, SZ_4K):
> quickspi_dma_init() passes the raw value and dma_set_max_packet_size()
> rounds it up.  setup_dma_buffers() maps that rounded size and
> read_dma_buffer() bounds the message against it, so a controller reporting
> max_input_len 64 and rep_desc_len 600 gets a 600 byte buffer behind a 4096
> byte DMA.  thc_rxdma_read() has no capacity argument, so nothing downstream
> can catch it.
> 
> The intel-quicki2c sibling floors its input buffer at SZ_4K for this reason, with the
> comment "give default 4K buffer to avoid DMA buffer overrun".  Round up the
> same way the DMA does.
> 
> Fixes: 4138f21115ae ("HID: intel-thc-hid: intel-quickspi: Complete THC QuickSPI
> driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: HyeongJun An <sammiee5311@xxxxxxxxx>
> ---
>  drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> index 89226f5ce45e..9ef33574c202 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> @@ -9,6 +9,7 @@
>  #include <linux/interrupt.h>
>  #include <linux/irqreturn.h>
>  #include <linux/pci.h>
> +#include <linux/sizes.h>
>  #include <linux/pm_runtime.h>
> 
>  #include <linux/gpio/consumer.h>
> @@ -549,8 +550,12 @@ static int quickspi_alloc_report_buf(struct
> quickspi_device *qsdev)
>  	if (!qsdev->report_descriptor)
>  		return -ENOMEM;
> 
> -	max_input_len = max(le16_to_cpu(qsdev->dev_desc.rep_desc_len),
> -			    le16_to_cpu(qsdev->dev_desc.max_input_len));
> +	/*
> +	 * thc_dma_set_max_packet_sizes() rounds the RXDMA2 packet size up
> to
> +	 * 4K, so the DMA can hand back more than max_input_len bytes.
> +	 */
> +	max_input_len = max_t(size_t, le16_to_cpu(qsdev-
> >dev_desc.rep_desc_len),
> +			      ALIGN(le16_to_cpu(qsdev-
> >dev_desc.max_input_len), SZ_4K));

This is the same case I explained in quicki2c patch https://lore.kernel.org/linux-input/IA1PR11MB609867952C6FAA206ECDAE32F4AD2@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/
It's not a real issue.

Best Regards,
Even Xu

> 
>  	qsdev->input_buf = devm_kzalloc(qsdev->dev, max_input_len,
> GFP_KERNEL);
>  	if (!qsdev->input_buf)
> --
> 2.43.0