* [PATCH] dmaengine: ste_dma40: fix out-of-bounds access from D40_MEMCPY_MAX_CHANS
@ 2026-05-31 21:07 Rosen Penev
2026-06-02 8:48 ` Linus Walleij
0 siblings, 1 reply; 3+ messages in thread
From: Rosen Penev @ 2026-05-31 21:07 UTC (permalink / raw)
To: dmaengine
Cc: Linus Walleij, Vinod Koul, Frank Li, Lee Jones, Arnd Bergmann,
moderated list:ARM/NOMADIK/Ux500 ARCHITECTURES, open list
D40_MEMCPY_MAX_CHANS is defined as 8, but the dma40_memcpy_channels[]
array only has 6 elements. This mismatch causes an out-of-bounds
issue:
1. d40_of_probe() accepts up to 8 memcpy channels from DT
(num_memcpy > D40_MEMCPY_MAX_CHANS allows 7-8), then writes them
into the 6-element dma40_memcpy_channels[], corrupting adjacent
stack memory.
Fix by defining D40_MEMCPY_MAX_CHANS as 6 to match the array size.
Fixes: a7dacb68b35a ("dmaengine: ste_dma40: Allow memcpy channels to be configured from DT")
Assisted-by: Opencode:Big-Pickle
Signed-off-by: Rosen Penev <rosenp@gmail•com>
---
drivers/dma/ste_dma40.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 0d9ffa3e2663..c45643b7f415 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -86,7 +86,7 @@ struct stedma40_platform_data {
#define D40_ALLOC_PHY BIT(30)
#define D40_ALLOC_LOG_FREE 0
-#define D40_MEMCPY_MAX_CHANS 8
+#define D40_MEMCPY_MAX_CHANS 6
/* Reserved event lines for memcpy only. */
#define DB8500_DMA_MEMCPY_EV_0 51
--
2.54.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] dmaengine: ste_dma40: fix out-of-bounds access from D40_MEMCPY_MAX_CHANS
2026-05-31 21:07 [PATCH] dmaengine: ste_dma40: fix out-of-bounds access from D40_MEMCPY_MAX_CHANS Rosen Penev
@ 2026-06-02 8:48 ` Linus Walleij
2026-06-02 8:53 ` Rosen Penev
0 siblings, 1 reply; 3+ messages in thread
From: Linus Walleij @ 2026-06-02 8:48 UTC (permalink / raw)
To: Rosen Penev
Cc: dmaengine, Vinod Koul, Frank Li, Lee Jones, Arnd Bergmann,
moderated list:ARM/NOMADIK/Ux500 ARCHITECTURES, open list
On Sun, May 31, 2026 at 11:08 PM Rosen Penev <rosenp@gmail•com> wrote:
> D40_MEMCPY_MAX_CHANS is defined as 8, but the dma40_memcpy_channels[]
> array only has 6 elements. This mismatch causes an out-of-bounds
> issue:
>
> 1. d40_of_probe() accepts up to 8 memcpy channels from DT
> (num_memcpy > D40_MEMCPY_MAX_CHANS allows 7-8), then writes them
> into the 6-element dma40_memcpy_channels[], corrupting adjacent
> stack memory.
>
> Fix by defining D40_MEMCPY_MAX_CHANS as 6 to match the array size.
>
> Fixes: a7dacb68b35a ("dmaengine: ste_dma40: Allow memcpy channels to be configured from DT")
> Assisted-by: Opencode:Big-Pickle
> Signed-off-by: Rosen Penev <rosenp@gmail•com>
Excellent find Rosen!
Reviewed-by: Linus Walleij <linusw@kernel•org>
Yours,
Linus Walleij
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] dmaengine: ste_dma40: fix out-of-bounds access from D40_MEMCPY_MAX_CHANS
2026-06-02 8:48 ` Linus Walleij
@ 2026-06-02 8:53 ` Rosen Penev
0 siblings, 0 replies; 3+ messages in thread
From: Rosen Penev @ 2026-06-02 8:53 UTC (permalink / raw)
To: Linus Walleij
Cc: dmaengine, Vinod Koul, Frank Li, Lee Jones, Arnd Bergmann,
moderated list:ARM/NOMADIK/Ux500 ARCHITECTURES, open list
On Tue, Jun 2, 2026 at 1:48 AM Linus Walleij <linusw@kernel•org> wrote:
>
> On Sun, May 31, 2026 at 11:08 PM Rosen Penev <rosenp@gmail•com> wrote:
>
> > D40_MEMCPY_MAX_CHANS is defined as 8, but the dma40_memcpy_channels[]
> > array only has 6 elements. This mismatch causes an out-of-bounds
> > issue:
> >
> > 1. d40_of_probe() accepts up to 8 memcpy channels from DT
> > (num_memcpy > D40_MEMCPY_MAX_CHANS allows 7-8), then writes them
> > into the 6-element dma40_memcpy_channels[], corrupting adjacent
> > stack memory.
> >
> > Fix by defining D40_MEMCPY_MAX_CHANS as 6 to match the array size.
> >
> > Fixes: a7dacb68b35a ("dmaengine: ste_dma40: Allow memcpy channels to be configured from DT")
> > Assisted-by: Opencode:Big-Pickle
> > Signed-off-by: Rosen Penev <rosenp@gmail•com>
>
> Excellent find Rosen!
All credit is to our robot overl-i mean sashiko. I'm under the
impression nothing can get merged unless it's happy.
> Reviewed-by: Linus Walleij <linusw@kernel•org>
>
> Yours,
> Linus Walleij
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-02 8:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-31 21:07 [PATCH] dmaengine: ste_dma40: fix out-of-bounds access from D40_MEMCPY_MAX_CHANS Rosen Penev
2026-06-02 8:48 ` Linus Walleij
2026-06-02 8:53 ` Rosen Penev
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox