Re: [PATCHv4] dmaengine: bestcomm: gen_bd: fix out-of-bounds access in PSC parameter lookup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] dmaengine: bestcomm: useless struct declaration mixed with code
--

commit b34f7960c5a14d5c07b8bccee4d8da1a3d8c6985
Author: Rosen Penev <rosenp@gmail.com>

dmaengine: bestcomm: gen_bd: fix out-of-bounds access in PSC parameter lookup

The bcom_psc_params[] array has 6 entries (indices 0-5), but
bcom_psc_gen_bd_rx_init() checked against MPC52xx_PSC_MAXNUM which can
be 12 when CONFIG_PPC_MPC512x is set, allowing indices 6-11 to pass
and read past the array. The tx init function had no bounds check at
all.

> diff --git a/drivers/dma/bestcomm/gen_bd.c b/drivers/dma/bestcomm/gen_bd.c
> index 8a24a5cbc2633..43e5bdd6937ec 100644
> --- a/drivers/dma/bestcomm/gen_bd.c
> +++ b/drivers/dma/bestcomm/gen_bd.c
[ ... ]
> @@ -336,6 +336,9 @@ EXPORT_SYMBOL_GPL(bcom_psc_gen_bd_rx_init);
>  struct bcom_task *
>  bcom_psc_gen_bd_tx_init(unsigned psc_num, int queue_len, phys_addr_t fifo)
>  {
> +	if (psc_num >= ARRAY_SIZE(bcom_psc_params))
> +		return NULL;
> +
>  	struct psc;

[Severity: Low]
Is this struct psc; declaration needed here? It appears to be a useless
forward declaration that is now awkwardly positioned after an active
statement in bcom_psc_gen_bd_tx_init().

>  	return bcom_gen_bd_tx_init(queue_len, fifo,
>  				   bcom_psc_params[psc_num].tx_initiator,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260915072608.57887-1-rosenp@gmail.com?part=1