Re: [PATCH v6 17/23] dmaengine: ste_dma40: Validate DMA specifier length

[Frank Li <Frank.li@oss.nxp.com>]

On Thu, Sep 24, 2026 at 10:35:29AM +0200, Linus Walleij wrote:
> The DMA40 binding requires three cells, but d40_xlate() reads args[0],
> args[1], and args[2] without checking args_count. A malformed provider node
> can specify fewer cells, leaving some of these values uninitialized when
> the OF DMA core invokes the translation callback.
>
> Reject specifiers that do not contain exactly three cells before reading
> the argument array.
>
> Fixes: fa332de5c6b3 ("dmaengine: ste_dma40: Supply full Device Tree parsing support")
> Assisted-by: LLM
> Signed-off-by: Linus Walleij <linusw@kernel.org>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/ste_dma40.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
> index ed233676e718..660ac63efb40 100644
> --- a/drivers/dma/ste_dma40.c
> +++ b/drivers/dma/ste_dma40.c
> @@ -2545,6 +2545,9 @@ static struct dma_chan *d40_xlate(struct of_phandle_args *dma_spec,
>  	dma_cap_mask_t cap;
>  	u32 flags;
>
> +	if (dma_spec->args_count != 3)
> +		return NULL;
> +
>  	memset(&cfg, 0, sizeof(struct stedma40_chan_cfg));
>
>  	dma_cap_zero(cap);
>
> --
> 2.55.0
>