[PATCH] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[PATCH] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[Christian Taedcke via B4 Relay]

From: Christian Taedcke <christian.taedcke@weidmueller.com>

When one irq is used for errors and each channel gets a dedicated irq,
the total number of irqs is num_channels + 1. If the error irq is not
the last entry in irqbuf[] but an earlier one, the loop assigning
per-channel irqs terminates one iteration too early and the last
channel is left without an irq.

Iterate over all collected irqs instead of num_channels so the
error-irq skip does not shorten the effective channel count.

Fixes: 188c6ba1dd92 ("dmaengine: nbpfaxi: Fix memory corruption in probe()")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Taedcke <christian.taedcke@weidmueller.com>
---
 drivers/dma/nbpfaxi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
index 05d7321629cc..74ff7bd979e2 100644
--- a/drivers/dma/nbpfaxi.c
+++ b/drivers/dma/nbpfaxi.c
@@ -1374,7 +1374,7 @@ static int nbpf_probe(struct platform_device *pdev)
 		if (irqs == num_channels + 1) {
 			struct nbpf_channel *chan;
 
-			for (i = 0, chan = nbpf->chan; i < num_channels;
+			for (i = 0, chan = nbpf->chan; i < irqs;
 			     i++, chan++) {
 				/* Skip the error IRQ */
 				if (irqbuf[i] == eirq)

---
base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
change-id: 20260702-upstreaming-nbpfaxi-v1-0364e355af85

Best regards,
--  
Christian Taedcke <christian.taedcke@weidmueller.com>

Re: [PATCH] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[Dan Carpenter]

On Thu, Jul 02, 2026 at 03:43:29PM +0200, Christian Taedcke via B4 Relay wrote:
> From: Christian Taedcke <christian.taedcke@weidmueller.com>
> 
> When one irq is used for errors and each channel gets a dedicated irq,
> the total number of irqs is num_channels + 1. If the error irq is not
> the last entry in irqbuf[] but an earlier one, the loop assigning
> per-channel irqs terminates one iteration too early and the last
> channel is left without an irq.
> 
> Iterate over all collected irqs instead of num_channels so the
> error-irq skip does not shorten the effective channel count.
> 
> Fixes: 188c6ba1dd92 ("dmaengine: nbpfaxi: Fix memory corruption in probe()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Taedcke <christian.taedcke@weidmueller.com>
> ---
>  drivers/dma/nbpfaxi.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
> index 05d7321629cc..74ff7bd979e2 100644
> --- a/drivers/dma/nbpfaxi.c
> +++ b/drivers/dma/nbpfaxi.c
> @@ -1374,7 +1374,7 @@ static int nbpf_probe(struct platform_device *pdev)
>  		if (irqs == num_channels + 1) {
>  			struct nbpf_channel *chan;
>  
> -			for (i = 0, chan = nbpf->chan; i < num_channels;
> +			for (i = 0, chan = nbpf->chan; i < irqs;
>  			     i++, chan++) {
>  				/* Skip the error IRQ */
>  				if (irqbuf[i] == eirq)
> 
> ---

Ah.  Thanks.  I feel like it would make sense to change the other
condition as well to:

-                       for (i = 0, chan = nbpf->chan; i < num_channels;
+                       for (i = 0, chan = nbpf->chan; i < irqs;
                             i++, chan++) {
                                /* Skip the error IRQ */
                                if (irqbuf[i] == eirq)
                                        i++;
-                               if (i >= ARRAY_SIZE(irqbuf))
+                               if (i >= num_channels)
                                        return -EINVAL;
                                chan->irq = irqbuf[i];

If we don't find the error IRQ then it would be possible to go out of
bounds of the chan->irq.  It's not likely to happen in real life but it
sort of makes the code make more sense?

regards,
dan carpenter