Re: [PATCH v9 15/19] dmaengine: ti: k3-psil-am62l: Add AM62Lx PSIL and PDMA data

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] dmaengine: uninitialized stack variable use in psil_set_new_ep_config()
- [Low] dmaengine: misleading error log in psil_set_new_ep_config()
--

commit 3b16508e4409dd766b60b58e1c4dabc6cf392380
Author: Sai Sree Kartheek Adivi <s-adivi@ti.com>

dmaengine: ti: k3-psil-am62l: Add AM62Lx PSIL and PDMA data

This patch adds PSIL and PDMA data for the AM62Lx SoC. It also introduces a
new PSIL_EP_PDMA_XYMF type and adds a fifo_id field to psil_endpoint_config.

> diff --git a/drivers/dma/ti/k3-psil.c b/drivers/dma/ti/k3-psil.c
> index c4b6f0df46861..580fc553e23fa 100644
> --- a/drivers/dma/ti/k3-psil.c
> +++ b/drivers/dma/ti/k3-psil.c
[ ... ]
> @@ -90,9 +147,22 @@ int psil_set_new_ep_config(struct device *dev, const char *name,
>  				       index, &dma_spec))
>  		return -ENOENT;
>  
> -	thread_id = dma_spec.args[0];
> -
> -	dst_ep_config = psil_get_ep_config(thread_id);
> +	if (of_device_is_compatible(dma_spec.np, "ti,am62l-dmss-pktdma")) {
> +		bool dev_to_mem;
> +
> +		dst_ep_config = psil_get_ep_config_by_id(dma_spec.args[0],

[Severity: Medium]
If a malformed or improperly configured device tree specifies a #dma-cells
value less than 1 for pktdma nodes, of_parse_phandle_with_args() will populate
fewer elements in dma_spec.args than expected. Because dma_spec is not
zero-initialized, does this code read uninitialized stack memory from
dma_spec.args[0] without verifying dma_spec.args_count >= 1?

> +							  true,
> +							  &thread_id, &dev_to_mem);
> +	} else if (of_device_is_compatible(dma_spec.np, "ti,am62l-dmss-bcdma")) {
> +		bool dev_to_mem;
> +
> +		dst_ep_config = psil_get_ep_config_by_id(dma_spec.args[2],

[Severity: Medium]
Similarly, if #dma-cells is less than 3 for bcdma nodes, does this code read
uninitialized stack memory from dma_spec.args[2] without verifying
dma_spec.args_count >= 3?

> +							  false,
> +							  &thread_id, &dev_to_mem);
> +	} else {
> +		thread_id = dma_spec.args[0];
> +		dst_ep_config = psil_get_ep_config(thread_id);
> +	}
>  	if (IS_ERR(dst_ep_config)) {
>  		pr_err("PSIL: thread ID 0x%04x not defined in map\n",
>  		       thread_id);

[Severity: Low]
If psil_get_ep_config_by_id() fails to find a matching endpoint, it returns
an error pointer without modifying the thread_id variable, which is
initialized to 0 at the start of the function. Could this lead to misleading
error logs that print 0x0000 instead of the actual channel ID that failed the
lookup?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922064902.2719979-1-s-adivi@ti.com?part=15