From 9f1064ebe17cf3ab65ac6eb166398e02678aea33 Mon Sep 17 00:00:00 2001 From: Linus Walleij Date: Sun, 27 Sep 2026 11:03:30 +0200 Subject: [PATCH] dmaengine: ste_dma40: Validate DMA specifier length The DMA40 binding requires three cells, but d40_xlate() reads args[0], args[1], and args[2] without checking args_count. A malformed provider node can specify fewer cells, leaving some of these values uninitialized when the OF DMA core invokes the translation callback. Reject specifiers that do not contain exactly three cells before reading the argument array. Fixes: fa332de5c6b3 ("dmaengine: ste_dma40: Supply full Device Tree parsing support") Assisted-by: LLM Reviewed-by: Frank Li Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260927-dma40-fixes-v7-17-89f595e8851d@kernel.org Signed-off-by: Vinod Koul --- drivers/dma/ste_dma40.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c index 08e9262dc8cd..0c183a34edea 100644 --- a/drivers/dma/ste_dma40.c +++ b/drivers/dma/ste_dma40.c @@ -2537,6 +2537,9 @@ static struct dma_chan *d40_xlate(struct of_phandle_args *dma_spec, dma_cap_mask_t cap; u32 flags; + if (dma_spec->args_count != 3) + return NULL; + memset(&cfg, 0, sizeof(struct stedma40_chan_cfg)); dma_cap_zero(cap);