AMD General Hi team,
Please disregard/withdraw this patch. It was sent to the mailing list by mistake before internal review. Apologies for the noise. Regards, Prasad. > -----Original Message----- > From: Prasad Kummari <[email protected]> > Sent: Monday, September 28, 2026 4:28 PM > To: [email protected]; [email protected]; git (AMD-Xilinx) > <[email protected]>; Dhanawade, Mohan <[email protected]> > Cc: Simek, Michal <[email protected]>; Begari, Padmarao > <[email protected]>; Belsare, Akshay > <[email protected]>; Kummari, Prasad > <[email protected]> > Subject: [UBOOT PATCH] fpga: versalpl: fix OOB write in > versal_align_dma_buffer() > > versal_align_dma_buffer() rounds a misaligned pointer up with > ALIGN() and memmove()s the full payload there, writing up to > ARCH_DMA_MINALIGN-1 bytes past the end of the caller's buffer. > > Allocate a separate cache-aligned bounce buffer via > malloc_cache_aligned() and memcpy() into it instead, propagating -ENOMEM > on allocation failure and freeing it after use. > > A misaligned buffer larger than the available malloc pool now fails cleanly > with -ENOMEM instead of silently corrupting adjacent memory as before an > explicit, diagnosable failure is strictly preferable to undefined behavior > that > previously went unnoticed only because the caller's buffer happened to have > trailing slack. > > Fixes: 26e054c943a7 ("arm64: versal: fpga: Add PL bit stream load support") > Signed-off-by: Prasad Kummari <[email protected]> > --- > Note: > > Hardware validation was completed on VEK385 and VCK190 > - Aligned buffer, existing fast path remains unchanged no bounce > buffer is allocated. > - Misaligned buffer with a small payloa, A cache-line-aligned bounce buffer > is allocated, used, and freed correctly, with no memory leaks observed. > - Misaligned buffer with a payload larger than CONFIG_SYS_MALLOC_LEN > (VCK190, +72.7 MiB request against a 64 MiB heap): The operation > fails cleanly with -ENOMEM, without crashes or memory corruption. > > > ┌────────────┬───────────────────────┐ > │ Platform │ CONFIG_SYS_MALLOC_LEN │ > ├────────────┼───────────────────────┤ > │ Versal │ 64 MB │ > ├────────────┼───────────────────────┤ > │ Versal2 │ 64 MB │ > ├────────────┼───────────────────────┤ > │ Versal Net │ 32 MB │ > ├────────────┼───────────────────────┤ > > drivers/fpga/versalpl.c | 19 +++++++++++++++++-- > 1 file changed, 17 insertions(+), 2 deletions(-) > > diff --git a/drivers/fpga/versalpl.c b/drivers/fpga/versalpl.c index > 29d2a389fd9..1c121919db7 100644 > --- a/drivers/fpga/versalpl.c > +++ b/drivers/fpga/versalpl.c > @@ -17,8 +17,18 @@ static ulong versal_align_dma_buffer(ulong *buf, u32 > len) > ulong *new_buf; > > if ((ulong)buf != ALIGN((ulong)buf, ARCH_DMA_MINALIGN)) { > - new_buf = (ulong *)ALIGN((ulong)buf, > ARCH_DMA_MINALIGN); > - memmove(new_buf, buf, len); > + /* > + * ALIGN() rounds up, so an in-place forward memmove() > would > + * write past the end of the caller's buffer. Copy into a > + * separately allocated, cache-aligned bounce buffer instead. > + */ > + new_buf = malloc_cache_aligned(len); > + if (!new_buf) { > + printf("%s: Failed to allocate aligned buffer\n", > + __func__); > + return 0; > + } > + memcpy(new_buf, buf, len); > buf = new_buf; > } > > @@ -37,6 +47,8 @@ static int versal_load(xilinx_desc *desc, const void *buf, > size_t bsize, > int ret; > > bin_buf = versal_align_dma_buffer((ulong *)buf, bsize); > + if (!bin_buf) > + return -ENOMEM; > > debug("%s called!\n", __func__); > flush_dcache_range(bin_buf, bin_buf + bsize); @@ -45,6 +57,9 @@ > static int versal_load(xilinx_desc *desc, const void *buf, size_t bsize, > if (ret) > printf("PL FPGA LOAD failed with err: 0x%08x\n", ret); > > + if (bin_buf != (ulong)buf) > + free((void *)bin_buf); > + > return ret; > } > > -- > 2.43.0
