[PATCH v2] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[PATCH v2] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[Christian Taedcke via B4 Relay]

From: Christian Taedcke <christian.taedcke@weidmueller.com>

When one irq is used for errors and each channel gets a dedicated irq,
the total number of irqs is num_channels + 1. If the error irq is not
the last entry in irqbuf[] but an earlier one, the loop assigning
per-channel irqs terminates one iteration too early and the last
channel is left without an irq.

Iterate over all collected irqs instead of num_channels so the
error-irq skip does not shorten the effective channel count.

Fixes: 188c6ba1dd92 ("dmaengine: nbpfaxi: Fix memory corruption in probe()")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Taedcke <christian.taedcke@weidmueller.com>
---
Changes in v2:
- Advance chan only when assigning a real irq to fix out-of-bounds
  memory access.
- Remove now redundant ARRAY_SIZE(irqbuf) check.
- Link to v1: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v1-1-fd8ea8830cea@weidmueller.com

To: christian.taedcke-oss@weidmueller.com
To: Vinod Koul <vkoul@kernel.org>
To: Frank Li <Frank.Li@kernel.org>
To: Dan Carpenter <error27@gmail.com>
Cc: dmaengine@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
---
 drivers/dma/nbpfaxi.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
index 05d7321629cc..bcfab62a71d7 100644
--- a/drivers/dma/nbpfaxi.c
+++ b/drivers/dma/nbpfaxi.c
@@ -1374,14 +1374,12 @@ static int nbpf_probe(struct platform_device *pdev)
 		if (irqs == num_channels + 1) {
 			struct nbpf_channel *chan;
 
-			for (i = 0, chan = nbpf->chan; i < num_channels;
-			     i++, chan++) {
+			for (i = 0, chan = nbpf->chan; i < irqs; i++) {
 				/* Skip the error IRQ */
 				if (irqbuf[i] == eirq)
-					i++;
-				if (i >= ARRAY_SIZE(irqbuf))
-					return -EINVAL;
+					continue;
 				chan->irq = irqbuf[i];
+				chan++;
 			}
 		} else {
 			/* 2 IRQs and more than one channel */

---
base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
change-id: 20260702-upstreaming-nbpfaxi-v1-0364e355af85

Best regards,
--  
Christian Taedcke <christian.taedcke@weidmueller.com>

Re: [PATCH v2] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

New issues:
- [High] Heap buffer overflow in channel IRQ assignment loop if the 'error' IRQ is not in `irqbuf`.

Pre-existing issues:
- [High] Infinite loop in `nbpf_probe()` if the device tree provides fewer than 9 interrupts.
- [High] Use-after-free on probe error paths due to missing `tasklet_kill()`.
--

commit 20180c724c3634307b1f833b241c0ea7d9e4c009
Author: Christian Taedcke <christian.taedcke@weidmueller.com>

dmaengine: nbpfaxi: Fix setting channel irqs in probe()

This commit changes the per-channel IRQ assignment loop to iterate over the
total number of collected IRQs instead of the channel count. This ensures
that skipping the error IRQ does not prematurely terminate the loop and leave
the last channel without an assigned IRQ.

> diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
> index 05d7321629cc8..bcfab62a71d75 100644
> --- a/drivers/dma/nbpfaxi.c
> +++ b/drivers/dma/nbpfaxi.c
> @@ -1374,14 +1374,12 @@ static int nbpf_probe(struct platform_device *pdev)
>  		if (irqs == num_channels + 1) {
>  			struct nbpf_channel *chan;
>  
> -			for (i = 0, chan = nbpf->chan; i < num_channels;
> -			     i++, chan++) {
> +			for (i = 0, chan = nbpf->chan; i < irqs; i++) {
>  				/* Skip the error IRQ */
>  				if (irqbuf[i] == eirq)
> -					i++;
> -				if (i >= ARRAY_SIZE(irqbuf))
> -					return -EINVAL;
> +					continue;
>  				chan->irq = irqbuf[i];
> +				chan++;
>  			}

[Severity: High]
If a malformed device tree causes the 'error' interrupt to not match any
of the interrupts in irqbuf, the continue statement will never be reached.
Could this lead to chan being incremented num_channels + 1 times, causing an
out-of-bounds write to the nbpf->chan array on the final iteration?

[Severity: High]
This is a pre-existing issue, but looking earlier in nbpf_probe(),
there appears to be a problem if the device tree provides fewer than 9
interrupts:

drivers/dma/nbpfaxi.c:nbpf_probe() {
	...
	for (i = 0; irqs < ARRAY_SIZE(irqbuf); i++) {
		irq = platform_get_irq_optional(pdev, i);
		if (irq < 0 && irq != -ENXIO)
			return irq;
		if (irq > 0)
			irqbuf[irqs++] = irq;
	}
	...
}

If platform_get_irq_optional() returns -ENXIO, irqs is not incremented.
Would this cause an infinite loop where i increments endlessly because irqs
never reaches ARRAY_SIZE(irqbuf)?

[Severity: High]
This is a pre-existing issue, but I also noticed a potential use-after-free
later in nbpf_probe() during error handling:

drivers/dma/nbpfaxi.c:nbpf_probe() {
	...
	ret = clk_prepare_enable(nbpf->clk);
	if (ret < 0)
		return ret;
	...
}

If clk_prepare_enable() fails, the function returns without killing the
tasklets initialized in nbpf_chan_probe(). If a shared interrupt fires before
the devres framework frees the IRQ and memory, could this schedule a tasklet
that accesses the freed nbpf structure?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702-upstreaming-nbpfaxi-v1-v2-1-e6d6b178a278@weidmueller.com?part=1