From c96e9f056095825b5f8d4a11f4107fc174892f92 Mon Sep 17 00:00:00 2001 From: Linus Walleij Date: Sun, 27 Sep 2026 11:03:29 +0200 Subject: [PATCH] dmaengine: ste_dma40: Validate disabled channel indexes d40_of_probe() checks how many entries disabled-channels contains, but not the channel numbers themselves. d40_phy_res_init() later uses every value as an index into base->phy_res, whose size is the number of channels found in this DMA40 instance. An out-of-range value can therefore write beyond the allocation. Validate each disabled channel against the detected hardware channel count before allocating and initializing the channel resources. Fixes: 499c2bc3cc89 ("dmaengine: ste_dma40: Fetch disabled channels from DT") Assisted-by: LLM Reviewed-by: Frank Li Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20260927-dma40-fixes-v7-16-89f595e8851d@kernel.org Signed-off-by: Vinod Koul --- drivers/dma/ste_dma40.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c index 8847bd60bbd9..08e9262dc8cd 100644 --- a/drivers/dma/ste_dma40.c +++ b/drivers/dma/ste_dma40.c @@ -3414,6 +3414,15 @@ static int __init d40_hw_detect_init(struct platform_device *pdev, num_phy_chans = min(num_phy_chans, STEDMA40_MAX_PHYS); + for (i = 0; plat_data->disabled_channels[i] != -1; i++) { + int chan = plat_data->disabled_channels[i]; + + if (chan < 0 || chan >= num_phy_chans) { + dev_err(dev, "Invalid disabled channel %d\n", chan); + return -EINVAL; + } + } + /* The number of channels used for memcpy */ num_memcpy_chans = plat_data->num_of_memcpy_chans; num_log_chans = num_phy_chans * D40_MAX_LOG_CHAN_PER_PHY;