Re: [PATCHv3] dmaengine: ste_dma40: turn d40_base phy_chans into a flexible array

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds read and write on `dma40_memcpy_channels` due to incorrect array size and clamping limit.
--

commit f80ed233c1567c0d1ee4933ba428492ac35dc443
Author: Rosen Penev <rosenp@gmail.com>

dmaengine: ste_dma40: turn d40_base phy_chans into a flexible array

Convert the separately-offset phy_chans pointer to a C99 flexible array
member at the end of struct d40_base, and switch the allocation to
struct_size().

> diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
> index 9b803c0aec254..0d9ffa3e26639 100644
> --- a/drivers/dma/ste_dma40.c
> +++ b/drivers/dma/ste_dma40.c

[ ... ]

> @@ -3185,22 +3186,24 @@ static int __init d40_hw_detect_init(struct platform_device *pdev,
>  	else
>  		num_phy_chans = 4 * (readl(virtbase + D40_DREG_ICFG) & 0x7) + 4;
>  
> +	num_phy_chans = min(num_phy_chans, STEDMA40_MAX_PHYS);
> +
>  	/* The number of channels used for memcpy */
>  	if (plat_data->num_of_memcpy_chans)
>  		num_memcpy_chans = plat_data->num_of_memcpy_chans;
>  	else
>  		num_memcpy_chans = ARRAY_SIZE(dma40_memcpy_channels);
>  
> +	num_memcpy_chans = min(num_memcpy_chans, D40_MEMCPY_MAX_CHANS);

[Severity: High]
This isn't a bug introduced by this patch, but does this clamping limit allow
out-of-bounds accesses on the dma40_memcpy_channels array?

The dma40_memcpy_channels array has exactly 6 elements, but
D40_MEMCPY_MAX_CHANS is 8.

When d40_of_probe() is called, it permits num_memcpy up to 8 and writes
them into the array:

drivers/dma/ste_dma40.c:d40_of_probe() {
    ...
    of_property_read_u32_array(np, "memcpy-channels",
                               dma40_memcpy_channels,
                               num_memcpy);
    ...
}

Can this cause an out-of-bounds write corrupting adjacent memory?

Additionally, because num_memcpy_chans is clamped to 8 here in
d40_hw_detect_init(), it allows up to 8 memcpy channels to be registered.

When clients allocate these channels, d40_config_memcpy() indexes the array:

drivers/dma/ste_dma40.c:d40_config_memcpy() {
    ...
    d40c->dma_cfg.dev_type = dma40_memcpy_channels[d40c->chan.chan_id];
    ...
}

If chan_id is 6 or 7, won't this result in an out-of-bounds read?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260531020843.594892-1-rosenp@gmail.com?part=1