kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers/dma
History
Dan Carpenter f366b36c5e dmaengine: nbpfaxi: Fix memory corruption in probe() 
commit 188c6ba1dd upstream.

The nbpf->chan[] array is allocated earlier in the nbpf_probe() function
and it has "num_channels" elements.  These three loops iterate one
element farther than they should and corrupt memory.

The changes to the second loop are more involved.  In this case, we're
copying data from the irqbuf[] array into the nbpf->chan[] array.  If
the data in irqbuf[i] is the error IRQ then we skip it, so the iterators
are not in sync.  I added a check to ensure that we don't go beyond the
end of the irqbuf[] array.  I'm pretty sure this can't happen, but it
seemed harmless to add a check.

On the other hand, after the loop has ended there is a check to ensure
that the "chan" iterator is where we expect it to be.  In the original
code we went one element beyond the end of the array so the iterator
wasn't in the correct place and it would always return -EINVAL.  However,
now it will always be in the correct place.  I deleted the check since
we know the result.

Cc: stable@vger.kernel.org
Fixes: b45b262cef ("dmaengine: add a driver for AMBA AXI NBPF DMAC IP cores")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/b13c5225-7eff-448c-badc-a2c98e9bcaca@sabinyo.mountain
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-07-24 08:51:49 +02:00
..
bestcomm treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 2) 2022-06-10 14:51:35 +02:00
dw dmaengine: dw: Select only supported masters for ACPI devices 2025-01-02 10:30:50 +01:00
dw-axi-dmac Avoid hw_desc array overrun in dw-axi-dmac 2024-06-27 13:46:17 +02:00
dw-edma dmaengine: dw-edma: Fix to enable to issue dma request on DMA processing 2023-05-11 23:03:37 +09:00
fsl-dpaa2-qdma dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools 2024-02-16 19:06:24 +01:00
hsu dmaengine: hsu: Include headers we are direct user of 2022-09-04 22:49:35 +05:30
idxd dmaengine: idxd: Fix passing freed memory in idxd_cdev_open() 2025-06-04 14:40:22 +02:00
ioat dmaengine: ioatdma: Fix missing kmem_cache_destroy() 2024-06-27 13:46:20 +02:00
ipu dmaengine: ipu: Fix fall-through warning for Clang 2021-07-13 14:38:47 -05:00
lgm dmaengine: lgm: Move DT parsing after initialization 2023-01-24 07:24:39 +01:00
mediatek dmaengine: mediatek: Fix deadlock caused by synchronize_irq() 2023-10-19 23:08:58 +02:00
ppc4xx treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_406.RULE 2022-06-10 14:51:37 +02:00
ptdma dmaengine: ptdma: use consistent DMA masks 2024-03-06 14:45:10 +00:00
qcom dma: gpi: remove spurious unlock in gpi_ch_init 2023-05-11 23:03:37 +09:00
sf-pdma dmaengine: sf-pdma: pdma_desc memory leak fix 2023-03-10 09:33:39 +01:00
sh dmaengine: shdma: increase size of 'dev_id' 2024-03-01 13:26:25 +01:00
ti dmaengine: ti: Add NULL check in udma_probe() 2025-06-27 11:07:16 +01:00
xilinx dmaengine: xilinx_dma: Set dma_device directions 2025-07-06 10:57:54 +02:00
acpi-dma.c dmaengine: acpi: Check for errors from acpi_register_gsi() separately 2021-08-06 21:48:11 +05:30
altera-msgdma.c dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor 2024-09-08 07:53:11 +02:00
amba-pl08x.c dmaengine: pl08x: Fix double word 2022-09-29 12:24:16 +05:30
apple-admac.c dmaengine: apple-admac: Avoid accessing registers in probe 2025-01-02 10:30:50 +01:00
at_hdmac.c dmaengine: at_hdmac: Check return code of dma_async_device_register 2022-11-08 10:43:57 +05:30
at_hdmac_regs.h dmaengine: at_hdmac: Fix at_lli struct definition 2022-11-08 10:43:56 +05:30
at_xdmac.c dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset 2025-01-02 10:30:50 +01:00
bcm-sba-raid.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_30.RULE (part 2) 2022-06-10 14:51:35 +02:00
bcm2835-dma.c dmaengine: bcm2835: Drop local dma_parms 2020-09-11 17:42:12 +05:30
dma-axi-dmac.c dmaengine: axi-dmac: fix possible race in remove() 2024-06-21 14:35:56 +02:00
dma-jz4780.c dmaengine: jz4780: fix typo in comment 2022-07-06 10:51:43 +05:30
dmaengine.c dmaengine: fix NULL pointer in channel unregistration function 2024-01-31 16:17:00 -08:00
dmaengine.h dmaengine: dmaengine_desc_callback_valid(): Check for callback_result 2021-10-25 09:42:56 +05:30
dmatest.c dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" 2025-05-22 14:10:03 +02:00
ep93xx_dma.c dmaengine: ep93xx: Fix typo in comments 2022-07-01 21:50:23 +05:30
fsl-edma-common.c dmaengine: fsl-edma: remove redundant assignment to pointer last_sg 2022-07-01 22:09:16 +05:30
fsl-edma-common.h dmaengine: fsl-edma: support edma memcpy 2021-10-28 22:56:24 +05:30
fsl-edma.c dmaengine: fsl-edma: support edma memcpy 2021-10-28 22:56:24 +05:30
fsl-qdma.c dmaengine: fsl-qdma: init irq after reg initialization 2024-03-06 14:45:10 +00:00
fsl_raid.c dmaengine: fsl: remove bad channel update 2020-10-05 09:59:17 +05:30
fsl_raid.h dmaengine: Driver support for FSL RaidEngine device. 2015-04-02 16:10:27 +05:30
fsldma.c dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function 2021-01-12 18:00:39 +05:30
fsldma.h fsldma: fix very broken 32-bit ppc ioread64 functionality 2020-08-29 13:50:56 -07:00
hisi_dma.c dmaengine: hisilicon: Dump regs to debugfs 2022-09-04 22:42:35 +05:30
idma64.c dmaengine: idma64: Add check for dma_set_max_seg_size 2024-06-12 11:03:34 +02:00
idma64.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
img-mdc-dma.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 422 2019-06-05 17:37:15 +02:00
imx-dma.c dmaengine: imx-dma: Cast of_device_get_match_data() with (uintptr_t) 2022-07-21 18:08:35 +05:30
imx-sdma.c dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init 2023-02-06 08:06:33 +01:00
iop-adma.c Merge branch 'topic/tasklet' into next 2020-10-01 10:18:59 +05:30
iop-adma.h treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
k3dma.c dmaengine: k3dma: use the correct HiSilicon copyright 2021-04-12 17:14:53 +05:30
Kconfig dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA 2024-03-26 18:20:45 -04:00
lpc18xx-dmamux.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
Makefile dmaengine: apple-admac: Add Apple ADMAC driver 2022-06-09 12:20:20 +05:30
mcf-edma.c dmaengine: mcf-edma: Fix a potential un-allocated memory access 2023-08-16 18:27:28 +02:00
milbeaut-hdmac.c dmaengine: milbeaut-hdmac: Prefer kcalloc over open coded arithmetic 2021-10-25 12:12:13 +05:30
milbeaut-xdmac.c dmaengine: milbeaut-xdmac: Fix a resource leak in the error handling path of the probe function 2020-12-29 10:08:00 +05:30
mmp_pdma.c dmaengine: mmp: deprecate '#dma-channels' 2022-05-19 22:53:46 +05:30
mmp_tdma.c dmaengine: mmp: convert tasklets to use new tasklet_setup() API 2020-09-18 12:19:06 +05:30
moxart-dma.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_56.RULE (part 2) 2022-06-10 14:51:35 +02:00
mpc512x_dma.c dmaengine: mpc512x: Fix fall-through warning for Clang 2021-07-14 11:05:55 -05:00
mv_xor.c dmaengine: mv_xor: fix child node refcount handling in early exit 2025-01-02 10:30:50 +01:00
mv_xor.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288 2019-06-05 17:36:37 +02:00
mv_xor_v2.c dmaengine: mv_xor_v2: Fix an error code. 2023-05-11 23:03:36 +09:00
mxs-dma.c dmaengine: mxs: use platform_driver_register 2022-09-29 12:05:20 +05:30
nbpfaxi.c dmaengine: nbpfaxi: Fix memory corruption in probe() 2025-07-24 08:51:49 +02:00
of-dma.c dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available 2021-07-28 12:54:50 +05:30
owl-dma.c dmaengine: owl: fix register access functions 2024-05-02 16:29:30 +02:00
pch_dma.c dmaengine: pch_dma: Remove usage of the deprecated "pci-dma-compat.h" API 2022-01-08 22:16:44 +05:30
pl330.c dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state" 2024-05-17 11:55:50 +02:00
plx_dma.c dmaengine: plx_dma: Move spin_lock_bh() to spin_lock() 2022-04-20 15:59:33 +05:30
pxa_dma.c dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() 2023-11-20 11:52:10 +01:00
s3c24xx-dma.c dmaengine: virt-dma: Fix double word in comments 2022-09-29 12:22:27 +05:30
sa11x0-dma.c dmaengine: sa11x0: Mark PM functions as __maybe_unused 2021-10-26 10:55:07 +05:30
sprd-dma.c dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed 2022-07-26 18:20:49 +05:30
st_fdma.c dmaengine: st_fdma: fix MODULE_ALIAS 2021-12-13 13:18:48 +05:30
st_fdma.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ste_dma40.c dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe 2023-11-08 14:10:58 +01:00
ste_dma40_ll.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 194 2019-05-30 11:29:22 -07:00
ste_dma40_ll.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 194 2019-05-30 11:29:22 -07:00
stm32-dma.c dmaengine: stm32-dma: avoid bitfield overflow assertion 2023-12-20 17:00:25 +01:00
stm32-dmamux.c dmaengine: stm32-dmamux: Simplify code and save a few bytes of memory 2022-09-05 11:52:28 +05:30
stm32-mdma.c dmaengine: stm32-mdma: correct desc prep when channel running 2023-11-28 17:07:13 +00:00
sun4i-dma.c dmaengine: sun4i: Set the maximum segment size 2022-07-05 18:34:26 +05:30
sun6i-dma.c dmaengine: sun6i: Add support for the D1 variant 2022-05-19 23:43:41 +05:30
tegra20-apb-dma.c dmaengine: tegra20-apb: stop checking config->slave_id 2021-12-17 11:23:38 +05:30
tegra186-gpc-dma.c dmaengine: tegra: Return correct DMA status when paused 2025-01-02 10:30:50 +01:00
tegra210-adma.c dmaengine: tegra210-adma: fix global intr clear 2023-01-24 07:24:39 +01:00
timb_dma.c dmaengine: timb_dma: convert tasklets to use new tasklet_setup() API 2020-09-18 12:19:07 +05:30
TODO dmaengine: dw: don't perform DMA when dmaengine_submit is called 2014-07-15 22:14:30 +05:30
txx9dmac.c dmaengine: txx9dmac: convert tasklets to use new tasklet_setup() API 2020-09-18 12:19:07 +05:30
txx9dmac.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
uniphier-mdmac.c dmaengine: uniphier-mdmac: replace zero-length array with flexible-array member 2020-02-13 20:15:57 +05:30
uniphier-xdmac.c dmaengine: uniphier-xdmac: Fix type of address variables 2022-01-03 17:49:37 +05:30
virt-dma.c dmaengine: virt-dma: convert tasklets to use new tasklet_setup() API 2020-09-18 12:19:07 +05:30
virt-dma.h dmaengine: virt-dma: Add missing locking around list operations 2019-12-26 10:04:18 +05:30
xgene-dma.c dmaengine: xgene: convert tasklets to use new tasklet_setup() API 2020-09-18 12:19:07 +05:30