From 0ac4a90c4805b41013044fdefff051ae59a54302 Mon Sep 17 00:00:00 2001 From: Linus Walleij Date: Sun, 27 Sep 2026 11:03:37 +0200 Subject: [PATCH] dmaengine: ste_dma40: Validate memcpy configuration d40_config_memcpy() builds a default memcpy configuration without passing it through d40_validate_conf(). A dev_type supplied through the memcpy-channels device tree property can therefore bypass the bounds checks added for client configurations. The generic DMA direction enum assigns zero to DMA_MEM_TO_MEM, unlike DMA40's old private enum. Allow memory-to-memory directions in the validator so checking the generated configuration does not reject all memcpy channels. Validate the generated memcpy configuration before deriving logical channel registers or allocating the channel. Fixes: 2c2b62d5d911 ("dmaengine: ste_dma40: Replace ST-E's home-brew DMA direction defs with generic ones") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/dmaengine/20260819225008.5F9651F000E9@smtp.kernel.org/ Assisted-by: LLM Reviewed-by: Frank Li Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260927-dma40-fixes-v7-24-89f595e8851d@kernel.org Signed-off-by: Vinod Koul --- drivers/dma/ste_dma40.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c index b809339f1776..0ffdfd9a1c9d 100644 --- a/drivers/dma/ste_dma40.c +++ b/drivers/dma/ste_dma40.c @@ -1890,7 +1890,8 @@ static int d40_validate_conf(struct d40_chan *d40c, d40c->base->gen_dmac.num_event_groups) invalid_dev_type = true; - if (!conf->dir) { + if (conf->dir != DMA_MEM_TO_MEM && + !is_slave_direction(conf->dir)) { chan_err(d40c, "Invalid direction.\n"); res = -EINVAL; } @@ -2185,12 +2186,17 @@ static int d40_allocate_channel(struct d40_chan *d40c, bool *first_phy_user) static int d40_config_memcpy(struct d40_chan *d40c) { dma_cap_mask_t cap = d40c->chan.device->cap_mask; + int ret; if (dma_has_cap(DMA_MEMCPY, cap) && !dma_has_cap(DMA_SLAVE, cap)) { d40c->dma_cfg = dma40_memcpy_conf_log; d40c->dma_cfg.dev_type = d40c->base->plat_data->memcpy_channels[d40c->chan.chan_id]; + ret = d40_validate_conf(d40c, &d40c->dma_cfg); + if (ret) + return ret; + d40_log_cfg(&d40c->dma_cfg, &d40c->log_def.lcsp1, &d40c->log_def.lcsp3); @@ -2198,6 +2204,10 @@ static int d40_config_memcpy(struct d40_chan *d40c) dma_has_cap(DMA_SLAVE, cap)) { d40c->dma_cfg = dma40_memcpy_conf_phy; + ret = d40_validate_conf(d40c, &d40c->dma_cfg); + if (ret) + return ret; + /* Generate interrupt at end of transfer or relink. */ d40c->dst_def_cfg |= BIT(D40_SREG_CFG_TIM_POS);