dmaengine: nbpfaxi: Fix possible array access out of bounds of nbpf->chan

[PATCH] dmaengine: nbpfaxi: Fix possible array access out of bounds of nbpf->chan

Posted by Thomas Fourier 3 months ago

The nbpf is alloc'd at line 1324 with a size of num_channels so it seems
like the maximum index of nbpf->chan should be num_channels - 1.

Fixes: b45b262cefd5 ("dmaengine: add a driver for AMBA AXI NBPF DMAC IP cores")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
---
 drivers/dma/nbpfaxi.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
index 0b75bb122898..dd1b5e2a603c 100644
--- a/drivers/dma/nbpfaxi.c
+++ b/drivers/dma/nbpfaxi.c
@@ -1364,7 +1364,7 @@ static int nbpf_probe(struct platform_device *pdev)
 	if (irqs == 1) {
 		eirq = irqbuf[0];
 
-		for (i = 0; i <= num_channels; i++)
+		for (i = 0; i < num_channels; i++)
 			nbpf->chan[i].irq = irqbuf[0];
 	} else {
 		eirq = platform_get_irq_byname(pdev, "error");
@@ -1374,7 +1374,7 @@ static int nbpf_probe(struct platform_device *pdev)
 		if (irqs == num_channels + 1) {
 			struct nbpf_channel *chan;
 
-			for (i = 0, chan = nbpf->chan; i <= num_channels;
+			for (i = 0, chan = nbpf->chan; i < num_channels;
 			     i++, chan++) {
 				/* Skip the error IRQ */
 				if (irqbuf[i] == eirq)
@@ -1391,7 +1391,7 @@ static int nbpf_probe(struct platform_device *pdev)
 			else
 				irq = irqbuf[0];
 
-			for (i = 0; i <= num_channels; i++)
+			for (i = 0; i < num_channels; i++)
 				nbpf->chan[i].irq = irq;
 		}
 	}
-- 
2.43.0

Re: [PATCH] dmaengine: nbpfaxi: Fix possible array access out of bounds of nbpf->chan

Posted by Vinod Koul 2 months, 3 weeks ago

On 07-07-25, 10:23, Thomas Fourier wrote:
> The nbpf is alloc'd at line 1324 with a size of num_channels so it seems
> like the maximum index of nbpf->chan should be num_channels - 1.

I have already applied a patch from Dan sent earlier for this

> 
> Fixes: b45b262cefd5 ("dmaengine: add a driver for AMBA AXI NBPF DMAC IP cores")
> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
> ---
>  drivers/dma/nbpfaxi.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
> index 0b75bb122898..dd1b5e2a603c 100644
> --- a/drivers/dma/nbpfaxi.c
> +++ b/drivers/dma/nbpfaxi.c
> @@ -1364,7 +1364,7 @@ static int nbpf_probe(struct platform_device *pdev)
>  	if (irqs == 1) {
>  		eirq = irqbuf[0];
>  
> -		for (i = 0; i <= num_channels; i++)
> +		for (i = 0; i < num_channels; i++)
>  			nbpf->chan[i].irq = irqbuf[0];
>  	} else {
>  		eirq = platform_get_irq_byname(pdev, "error");
> @@ -1374,7 +1374,7 @@ static int nbpf_probe(struct platform_device *pdev)
>  		if (irqs == num_channels + 1) {
>  			struct nbpf_channel *chan;
>  
> -			for (i = 0, chan = nbpf->chan; i <= num_channels;
> +			for (i = 0, chan = nbpf->chan; i < num_channels;
>  			     i++, chan++) {
>  				/* Skip the error IRQ */
>  				if (irqbuf[i] == eirq)
> @@ -1391,7 +1391,7 @@ static int nbpf_probe(struct platform_device *pdev)
>  			else
>  				irq = irqbuf[0];
>  
> -			for (i = 0; i <= num_channels; i++)
> +			for (i = 0; i < num_channels; i++)
>  				nbpf->chan[i].irq = irq;
>  		}
>  	}
> -- 
> 2.43.0

-- 
~Vinod