michael/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

staging: axis-fifo: fix TX handling on copy_from_user() failure

Browse Source 
If copy_from_user() fails, write() currently returns -EFAULT, but any
partially written data leaves the TX FIFO in an inconsistent state.
Subsequent write() calls then fail with "transmit length mismatch"
errors.

Once partial data is written to the hardware FIFO, it cannot be removed
without a TX reset. Commit c6e8d85faf ("staging: axis-fifo: Remove
hardware resets for user errors") removed a full FIFO reset for this case,
which fixed a potential RX data loss, but introduced this TX issue.

Fix this by introducing a bounce buffer: copy the full packet from
userspace first, and write to the hardware FIFO only if the copy
was successful.

Fixes: c6e8d85faf ("staging: axis-fifo: Remove hardware resets for user errors")
Cc: stable@vger.kernel.org
Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
Link: https://lore.kernel.org/r/20250912101322.1282507-1-ovidiu.panait.oss@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Ovidiu Panait
2025-09-12 13:13:21 +03:00
committed by Greg Kroah-Hartman
parent 52ff2b840b
commit 6d07bee10e
1 changed files with 10 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
drivers/staging/axis-fifo/axis-fifo.c
View File

@@ -43,7 +43,6 @@
#define DRIVER_NAME "axis_fifo"
#define READ_BUF_SIZE 128U /* read buffer length in words */
#define WRITE_BUF_SIZE 128U /* write buffer length in words */
#define AXIS_FIFO_DEBUG_REG_NAME_MAX_LEN 4
@@ -302,11 +301,8 @@ static ssize_t axis_fifo_write(struct file *f, const char __user *buf,
{
struct axis_fifo *fifo = (struct axis_fifo *)f->private_data;
unsigned int words_to_write;
unsigned int copied;
unsigned int copy;
unsigned int i;
u32 *txbuf;
int ret;
u32 tmp_buf[WRITE_BUF_SIZE];
if (len % sizeof(u32)) {
dev_err(fifo->dt_device,
@@ -371,32 +367,20 @@ static ssize_t axis_fifo_write(struct file *f, const char __user *buf,
}
}
/* write data from an intermediate buffer into the fifo IP, refilling
* the buffer with userspace data as needed
*/
copied = 0;
while (words_to_write > 0) {
copy = min(words_to_write, WRITE_BUF_SIZE);
if (copy_from_user(tmp_buf, buf + copied * sizeof(u32),
copy * sizeof(u32))) {
ret = -EFAULT;
goto end_unlock;
}
for (i = 0; i < copy; i++)
iowrite32(tmp_buf[i], fifo->base_addr +
XLLF_TDFD_OFFSET);
copied += copy;
words_to_write -= copy;
txbuf = vmemdup_user(buf, len);
if (IS_ERR(txbuf)) {
ret = PTR_ERR(txbuf);
goto end_unlock;
}
ret = copied * sizeof(u32);
for (int i = 0; i < words_to_write; ++i)
iowrite32(txbuf[i], fifo->base_addr + XLLF_TDFD_OFFSET);
/* write packet size to fifo */
iowrite32(ret, fifo->base_addr + XLLF_TLR_OFFSET);
iowrite32(len, fifo->base_addr + XLLF_TLR_OFFSET);
ret = len;
kvfree(txbuf);
end_unlock:
mutex_unlock(&fifo->write_lock);