d40_config_memcpy() builds a default memcpy configuration without passing it through d40_validate_conf(). A dev_type supplied through the memcpy-channels device tree property can therefore bypass the bounds checks added for client configurations.
Validate the generated memcpy configuration before deriving logical channel registers or allocating the channel. Reported-by: [email protected] Closes: https://lore.kernel.org/dmaengine/[email protected]/ Assisted-by: Codex:gpt-5-5 Signed-off-by: Linus Walleij <[email protected]> --- drivers/dma/ste_dma40.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c index e0c694a1fc8b..49bca706b638 100644 --- a/drivers/dma/ste_dma40.c +++ b/drivers/dma/ste_dma40.c @@ -2013,11 +2013,16 @@ static int d40_allocate_channel(struct d40_chan *d40c, bool *first_phy_user) static int d40_config_memcpy(struct d40_chan *d40c) { dma_cap_mask_t cap = d40c->chan.device->cap_mask; + int ret; if (dma_has_cap(DMA_MEMCPY, cap) && !dma_has_cap(DMA_SLAVE, cap)) { d40c->dma_cfg = dma40_memcpy_conf_log; d40c->dma_cfg.dev_type = dma40_memcpy_channels[d40c->chan.chan_id]; + ret = d40_validate_conf(d40c, &d40c->dma_cfg); + if (ret) + return ret; + d40_log_cfg(&d40c->dma_cfg, &d40c->log_def.lcsp1, &d40c->log_def.lcsp3); @@ -2025,6 +2030,10 @@ static int d40_config_memcpy(struct d40_chan *d40c) dma_has_cap(DMA_SLAVE, cap)) { d40c->dma_cfg = dma40_memcpy_conf_phy; + ret = d40_validate_conf(d40c, &d40c->dma_cfg); + if (ret) + return ret; + /* Generate interrupt at end of transfer or relink. */ d40c->dst_def_cfg |= BIT(D40_SREG_CFG_TIM_POS); -- 2.55.0
