usb: typec: ucsi: Don't truncate the reads

That may silently corrupt the data. Instead, failing attempts
to read more than the interface can handle.

Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Link: https://lore.kernel.org/r/20240816135859.3499351-3-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index 546352b53bc42bd08f0d521e1a308fa11299f200..250bd20f2cd9a96b55ff2813a688c9a6b1fce205 100644 (file)
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -99,12 +99,8 @@ static int ucsi_run_command(struct ucsi *ucsi, u64 command, u32 *cci,
 
        *cci = 0;
 
-       /*
-        * Below UCSI 2.0, MESSAGE_IN was limited to 16 bytes. Truncate the
-        * reads here.
-        */
-       if (ucsi->version <= UCSI_VERSION_1_2)
-               size = clamp(size, 0, 16);
+       if (size > UCSI_MAX_DATA_LENGTH(ucsi))
+               return -EINVAL;
 
        ret = ucsi->ops->sync_control(ucsi, command);
        if (ret)

diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h
index 6359baa22858ec6832a7af7566655108fdbe404d..e8ece3fdcbf2ce7c1e2b07acf21d6a23f901016b 100644 (file)
--- a/drivers/usb/typec/ucsi/ucsi.h
+++ b/drivers/usb/typec/ucsi/ucsi.h
@@ -415,6 +415,8 @@ struct ucsi {
 #define UCSI_DELAY_DEVICE_PDOS BIT(1)  /* Reading PDOs fails until the parter is in PD mode */
 };
 
+#define UCSI_MAX_DATA_LENGTH(u) (((u)->version < UCSI_VERSION_2_0) ? 0x10 : 0xff)
+
 #define UCSI_MAX_SVID          5
 #define UCSI_MAX_ALTMODES      (UCSI_MAX_SVID * 6)