Re: [PATCH v6 23/23] dmaengine: ste_dma40: Validate memcpy configuration

[Frank Li <Frank.li@oss.nxp.com>]

On Thu, Sep 24, 2026 at 10:35:35AM +0200, Linus Walleij wrote:
> d40_config_memcpy() builds a default memcpy configuration without passing
> it through d40_validate_conf(). A dev_type supplied through the
> memcpy-channels device tree property can therefore bypass the bounds
> checks added for client configurations.
>
> The generic DMA direction enum assigns zero to DMA_MEM_TO_MEM, unlike
> DMA40's old private enum. Allow memory-to-memory directions in the
> validator so checking the generated configuration does not reject all
> memcpy channels.
>
> Validate the generated memcpy configuration before deriving logical
> channel registers or allocating the channel.
>
> Fixes: 2c2b62d5d911 ("dmaengine: ste_dma40: Replace ST-E's home-brew DMA direction defs with generic ones")
> Reported-by: sashiko-bot@kernel.org
> Closes: https://lore.kernel.org/dmaengine/20260819225008.5F9651F000E9@smtp.kernel.org/
> Assisted-by: LLM
> Signed-off-by: Linus Walleij <linusw@kernel.org>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/ste_dma40.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
> index d65bf6cfea53..c10012026ea0 100644
> --- a/drivers/dma/ste_dma40.c
> +++ b/drivers/dma/ste_dma40.c
> @@ -1897,7 +1897,8 @@ static int d40_validate_conf(struct d40_chan *d40c,
>  	    d40c->base->gen_dmac.num_event_groups)
>  		invalid_dev_type = true;
>
> -	if (!conf->dir) {
> +	if (conf->dir != DMA_MEM_TO_MEM &&
> +	    !is_slave_direction(conf->dir)) {
>  		chan_err(d40c, "Invalid direction.\n");
>  		res = -EINVAL;
>  	}
> @@ -2171,12 +2172,17 @@ static int d40_allocate_channel(struct d40_chan *d40c, bool *first_phy_user)
>  static int d40_config_memcpy(struct d40_chan *d40c)
>  {
>  	dma_cap_mask_t cap = d40c->chan.device->cap_mask;
> +	int ret;
>
>  	if (dma_has_cap(DMA_MEMCPY, cap) && !dma_has_cap(DMA_SLAVE, cap)) {
>  		d40c->dma_cfg = dma40_memcpy_conf_log;
>  		d40c->dma_cfg.dev_type =
>  			d40c->base->plat_data->memcpy_channels[d40c->chan.chan_id];
>
> +		ret = d40_validate_conf(d40c, &d40c->dma_cfg);
> +		if (ret)
> +			return ret;
> +
>  		d40_log_cfg(&d40c->dma_cfg,
>  			    &d40c->log_def.lcsp1, &d40c->log_def.lcsp3);
>
> @@ -2184,6 +2190,10 @@ static int d40_config_memcpy(struct d40_chan *d40c)
>  		   dma_has_cap(DMA_SLAVE, cap)) {
>  		d40c->dma_cfg = dma40_memcpy_conf_phy;
>
> +		ret = d40_validate_conf(d40c, &d40c->dma_cfg);
> +		if (ret)
> +			return ret;
> +
>  		/* Generate interrupt at end of transfer or relink. */
>  		d40c->dst_def_cfg |= BIT(D40_SREG_CFG_TIM_POS);
>
>
> --
> 2.55.0
>