Re: [PATCH v6 16/23] dmaengine: ste_dma40: Validate disabled channel indexes

[Frank Li <Frank.li@oss.nxp.com>]

On Thu, Sep 24, 2026 at 10:35:28AM +0200, Linus Walleij wrote:
> d40_of_probe() checks how many entries disabled-channels contains, but not
> the channel numbers themselves. d40_phy_res_init() later uses every value
> as an index into base->phy_res, whose size is the number of channels found
> in this DMA40 instance. An out-of-range value can therefore write beyond
> the allocation.
>
> Validate each disabled channel against the detected hardware channel count
> before allocating and initializing the channel resources.
>
> Fixes: 499c2bc3cc89 ("dmaengine: ste_dma40: Fetch disabled channels from DT")
> Assisted-by: LLM
> Signed-off-by: Linus Walleij <linusw@kernel.org>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/ste_dma40.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
> index 24994e9bfbbb..ed233676e718 100644
> --- a/drivers/dma/ste_dma40.c
> +++ b/drivers/dma/ste_dma40.c
> @@ -3422,6 +3422,15 @@ static int __init d40_hw_detect_init(struct platform_device *pdev,
>
>  	num_phy_chans = min(num_phy_chans, STEDMA40_MAX_PHYS);
>
> +	for (i = 0; plat_data->disabled_channels[i] != -1; i++) {
> +		int chan = plat_data->disabled_channels[i];
> +
> +		if (chan < 0 || chan >= num_phy_chans) {
> +			dev_err(dev, "Invalid disabled channel %d\n", chan);
> +			return -EINVAL;
> +		}
> +	}
> +
>  	/* The number of channels used for memcpy */
>  	num_memcpy_chans = plat_data->num_of_memcpy_chans;
>  	num_log_chans = num_phy_chans * D40_MAX_LOG_CHAN_PER_PHY;
>
> --
> 2.55.0
>