github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

dmaengine: ste_dma40: Validate DMA specifier length

Browse Source 
The DMA40 binding requires three cells, but d40_xlate() reads args[0],
args[1], and args[2] without checking args_count. A malformed provider node
can specify fewer cells, leaving some of these values uninitialized when
the OF DMA core invokes the translation callback.

Reject specifiers that do not contain exactly three cells before reading
the argument array.

Fixes: fa332de5c6 ("dmaengine: ste_dma40: Supply full Device Tree parsing support")
Assisted-by: LLM
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260927-dma40-fixes-v7-17-89f595e8851d@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
This commit is contained in:
Linus Walleij 2026-09-27 11:03:30 +02:00 committed by Vinod Koul
parent c96e9f0560
commit 9f1064ebe1
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/dma/ste_dma40.c
View File

@ -2537,6 +2537,9 @@ static struct dma_chan *d40_xlate(struct of_phandle_args *dma_spec,
dma_cap_mask_t cap;
u32 flags;
if (dma_spec->args_count != 3)
return NULL;
memset(&cfg, 0, sizeof(struct stedma40_chan_cfg));
dma_cap_zero(cap);