[v2] dmaengine: ti: edma: Fix memory allocation size for queue_priority_map

[PATCHv2] dmaengine: ti: edma: Fix memory allocation size for queue_priority_map

Posted by Anders Roxell 5 months, 1 week ago

Fix a critical memory allocation bug in edma_setup_from_hw() where
queue_priority_map was allocated with insufficient memory. The code
declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8),
but allocated memory using sizeof(s8) instead of the correct size.

This caused out-of-bounds memory writes when accessing:
  queue_priority_map[i][0] = i;
  queue_priority_map[i][1] = i;

The bug manifested as kernel crashes with "Oops - undefined instruction"
on ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the
memory corruption triggered kernel hardening features on Clang.

Change the allocation to use sizeof(*queue_priority_map) which
automatically gets the correct size for the 2D array structure.

Fixes: 2b6b3b742019 ("ARM/dmaengine: edma: Merge the two drivers under drivers/dma/")
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
---
 drivers/dma/ti/edma.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
index 3ed406f08c44..552be71db6c4 100644
--- a/drivers/dma/ti/edma.c
+++ b/drivers/dma/ti/edma.c
@@ -2064,8 +2064,8 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
 	 * priority. So Q0 is the highest priority queue and the last queue has
 	 * the lowest priority.
 	 */
-	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
-					  GFP_KERNEL);
+	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1,
+					  sizeof(*queue_priority_map), GFP_KERNEL);
 	if (!queue_priority_map)
 		return -ENOMEM;
 
-- 
2.50.1

Re: [PATCHv2] dmaengine: ti: edma: Fix memory allocation size for queue_priority_map

Posted by Christophe JAILLET 5 months ago

Le 30/08/2025 à 11:49, Anders Roxell a écrit :
> Fix a critical memory allocation bug in edma_setup_from_hw() where
> queue_priority_map was allocated with insufficient memory. The code
> declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8),
> but allocated memory using sizeof(s8) instead of the correct size.
> 
> This caused out-of-bounds memory writes when accessing:
>    queue_priority_map[i][0] = i;
>    queue_priority_map[i][1] = i;
> 
> The bug manifested as kernel crashes with "Oops - undefined instruction"
> on ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the
> memory corruption triggered kernel hardening features on Clang.
> 
> Change the allocation to use sizeof(*queue_priority_map) which
> automatically gets the correct size for the 2D array structure.
> 
> Fixes: 2b6b3b742019 ("ARM/dmaengine: edma: Merge the two drivers under drivers/dma/")
> Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
> ---
>   drivers/dma/ti/edma.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
> index 3ed406f08c44..552be71db6c4 100644
> --- a/drivers/dma/ti/edma.c
> +++ b/drivers/dma/ti/edma.c
> @@ -2064,8 +2064,8 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
>   	 * priority. So Q0 is the highest priority queue and the last queue has
>   	 * the lowest priority.
>   	 */
> -	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
> -					  GFP_KERNEL);
> +	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1,
> +					  sizeof(*queue_priority_map), GFP_KERNEL);
>   	if (!queue_priority_map)
>   		return -ENOMEM;
>   

Hi,

for what it worth:
Acked-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

and for the records:
  
https://lore.kernel.org/all/8c95c485be294e64457606089a2a56e68e2ebd1a.1653153959.git.christophe.jaillet@wanadoo.fr/

;-)

IMHO, the applied solution is cleaner than mine.

Only the Fixes tag could be more relevant (because, the issue is older 
than 2b6b3b742019), but I don't think it will make any difference.

CJ

Re: [PATCHv2] dmaengine: ti: edma: Fix memory allocation size for queue_priority_map

Posted by Vinod Koul 5 months, 1 week ago

On Sat, 30 Aug 2025 11:49:53 +0200, Anders Roxell wrote:
> Fix a critical memory allocation bug in edma_setup_from_hw() where
> queue_priority_map was allocated with insufficient memory. The code
> declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8),
> but allocated memory using sizeof(s8) instead of the correct size.
> 
> This caused out-of-bounds memory writes when accessing:
>   queue_priority_map[i][0] = i;
>   queue_priority_map[i][1] = i;
> 
> [...]

Applied, thanks!

[1/1] dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
      commit: e63419dbf2ceb083c1651852209c7f048089ac0f

Best regards,
-- 
~Vinod