Re: [PATCH v6 22/23] dmaengine: ste_dma40: Validate fixed physical channel indexes

[Frank Li <Frank.li@oss.nxp.com>]

On Thu, Sep 24, 2026 at 10:35:34AM +0200, Linus Walleij wrote:
> Fixed physical memcpy allocation uses dma_cfg.phy_channel directly as an
> index into phy_res when use_fixed_channel is set. d40_validate_conf()
> validates dev_type but not the fixed physical channel, allowing an invalid
> configuration to access memory outside the array.
>
> Validate the fixed physical channel centrally before accepting the channel
> configuration.
>
> Fixes: f000df8c5a0e ("dmaengine: ste_dma40: support fixed physical channel allocation")
> Reported-by: sashiko-bot@kernel.org
> Closes: https://lore.kernel.org/dmaengine/20260819225008.5F9651F000E9@smtp.kernel.org/
> Assisted-by: LLM
> Signed-off-by: Linus Walleij <linusw@kernel.org>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/ste_dma40.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>
> diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
> index def2416fb1d0..d65bf6cfea53 100644
> --- a/drivers/dma/ste_dma40.c
> +++ b/drivers/dma/ste_dma40.c
> @@ -1918,6 +1918,14 @@ static int d40_validate_conf(struct d40_chan *d40c,
>  		res = -EINVAL;
>  	}
>
> +	if (conf->use_fixed_channel &&
> +	    (conf->phy_channel < 0 ||
> +	     conf->phy_channel >= d40c->base->num_phy_chans)) {
> +		chan_err(d40c, "Invalid physical channel (%d)\n",
> +			 conf->phy_channel);
> +		res = -EINVAL;
> +	}
> +
>  	if (conf->dir == DMA_DEV_TO_DEV) {
>  		/*
>  		 * DMAC HW supports it. Will be added to this driver,
>
> --
> 2.55.0
>