Dan Carpenter 122160289a dmaengine: nbpfaxi: Fix memory corruption in probe() ... commit 188c6ba1dd upstream. The nbpf->chan[] array is allocated earlier in the nbpf_probe() function and it has "num_channels" elements. These three loops iterate one element farther than they should and corrupt memory. The changes to the second loop are more involved. In this case, we're copying data from the irqbuf[] array into the nbpf->chan[] array. If the data in irqbuf[i] is the error IRQ then we skip it, so the iterators are not in sync. I added a check to ensure that we don't go beyond the end of the irqbuf[] array. I'm pretty sure this can't happen, but it seemed harmless to add a check. On the other hand, after the loop has ended there is a check to ensure that the "chan" iterator is where we expect it to be. In the original code we went one element beyond the end of the array so the iterator wasn't in the correct place and it would always return -EINVAL. However, now it will always be in the correct place. I deleted the check since we know the result. Cc: stable@vger.kernel.org Fixes: b45b262cef ("dmaengine: add a driver for AMBA AXI NBPF DMAC IP cores") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/b13c5225-7eff-448c-badc-a2c98e9bcaca@sabinyo.mountain Signed-off-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-07-24 08:56:25 +02:00
..
amd	dmaengine: amd: qdma: Remove using the private get and set dma_ops APIs	2025-01-02 10:34:14 +01:00
bestcomm
dw	dmaengine: dw: Select only supported masters for ACPI devices	2025-01-02 10:34:13 +01:00
dw-axi-dmac	dma: dw-axi-dmac: support per channel interrupt	2024-04-07 17:18:14 +05:30
dw-edma	dmaengine: dw-edma: Do not enable watermark interrupts for HDMA	2024-08-28 18:40:17 +05:30
fsl-dpaa2-qdma	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
hsu
idxd	dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using	2025-07-06 11:01:33 +02:00
ioat	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
lgm	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
mediatek	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
ppc4xx	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
ptdma	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
qcom	dmaengine updates for v6.12	2024-09-23 14:08:08 -07:00
sf-pdma
sh	dmaengine: sh: rz-dmac: handle configs where one address is zero	2024-10-14 23:10:58 +05:30
stm32	dmaengine: stm32-dma3: Set lli_size after allocation	2024-08-05 22:28:48 +05:30
ti	dmaengine: ti: Add NULL check in udma_probe()	2025-06-19 15:32:10 +02:00
xilinx	dmaengine: xilinx_dma: Set dma_device directions	2025-07-06 11:01:33 +02:00
acpi-dma.c	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
altera-msgdma.c	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
amba-pl08x.c	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
apple-admac.c	dmaengine: apple-admac: Avoid accessing registers in probe	2025-01-02 10:34:14 +01:00
at_hdmac.c	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
at_xdmac.c	dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset	2025-01-02 10:34:14 +01:00
bcm-sba-raid.c	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
bcm2835-dma.c	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
dma-axi-dmac.c	dmaengine: dma-axi-dmac: Implement device_prep_peripheral_dma_vec	2024-06-21 15:31:57 +05:30
dma-jz4780.c
dmaengine.c	dmaengine: avoid non-constant format string	2024-08-29 22:49:53 +05:30
dmaengine.h
dmatest.c	dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"	2025-05-22 14:29:44 +02:00
ep93xx_dma.c	dmaengine: cirrus: check that output may be truncated	2024-10-11 09:55:47 +00:00
fsl_raid.c
fsl_raid.h
fsl-edma-common.c	dmaengine: fsl-edma: change the memory access from local into remote mode in i.MX 8QM	2024-06-11 23:55:34 +05:30
fsl-edma-common.h	dmaengine: fsl-edma: implement the cleanup path of fsl_edma3_attach_pd()	2025-01-02 10:34:14 +01:00
fsl-edma-main.c	dmaengine: fsl-edma: Fix return code for unhandled interrupts	2025-05-29 11:03:15 +02:00
fsl-edma-trace.c	dmaengine: fsl-edma: add trace event support	2024-05-04 18:00:16 +05:30
fsl-edma-trace.h	dmaengine: fsl-edma: add trace event support	2024-05-04 18:00:16 +05:30
fsl-qdma.c
fsldma.c
fsldma.h
hisi_dma.c	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
idma64.c	dmaengine updates for v6.12	2024-09-23 14:08:08 -07:00
idma64.h
img-mdc-dma.c
imx-dma.c	dmaengine: imx-dma: Remove i.MX21 support	2024-08-29 22:49:07 +05:30
imx-sdma.c	dmaengine: imx-sdma: don't print warning when firmware is absent	2024-06-07 23:14:45 +05:30
k3dma.c
Kconfig	dmaengine: Add dma router for pl08x in LPC32XX SoC	2024-08-29 22:54:11 +05:30
loongson1-apb-dma.c	dmaengine: loongson1-apb-dma: Fix the build warning caused by the size of pdev_irqname	2024-09-02 13:56:32 +05:30
lpc18xx-dmamux.c
lpc32xx-dmamux.c	dmaengine: Add dma router for pl08x in LPC32XX SoC	2024-08-29 22:54:11 +05:30
ls2x-apb-dma.c	dmaengine: loongson2-apb: Change GENMASK to GENMASK_ULL	2025-01-02 10:34:21 +01:00
Makefile	dmaengine: Add dma router for pl08x in LPC32XX SoC	2024-08-29 22:54:11 +05:30
mcf-edma-main.c	dmaengine: fsl-edma: remove redundant "idle" field from fsl_chan	2024-06-11 23:55:34 +05:30
milbeaut-hdmac.c
milbeaut-xdmac.c
mmp_pdma.c
mmp_tdma.c
moxart-dma.c	dmaengine: moxart-dma: remove unused struct 'moxart_filter_data'	2024-06-11 23:55:34 +05:30
mpc512x_dma.c
mv_xor_v2.c	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
mv_xor.c	dmaengine: mv_xor: fix child node refcount handling in early exit	2025-01-02 10:34:13 +01:00
mv_xor.h	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
mxs-dma.c
nbpfaxi.c	dmaengine: nbpfaxi: Fix memory corruption in probe()	2025-07-24 08:56:25 +02:00
of-dma.c	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
owl-dma.c	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
pch_dma.c	dmaengine: pch_dma: remove unused function chan2parent	2024-04-07 18:36:58 +05:30
pl330.c	dma-mapping: don't return errors from dma_set_max_seg_size	2024-08-29 07:22:49 +03:00
plx_dma.c
pxa_dma.c
sa11x0-dma.c
sprd-dma.c
st_fdma.c
st_fdma.h
ste_dma40_ll.c
ste_dma40_ll.h	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
ste_dma40.c	dma-mapping: don't return errors from dma_set_max_seg_size	2024-08-29 07:22:49 +03:00
ste_dma40.h	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
sun4i-dma.c
sun6i-dma.c
tegra20-apb-dma.c	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30
tegra186-gpc-dma.c	dmaengine: tegra: Return correct DMA status when paused	2025-01-02 10:34:14 +01:00
tegra210-adma.c
timb_dma.c
TODO
txx9dmac.c
txx9dmac.h
uniphier-mdmac.c
uniphier-xdmac.c
virt-dma.c	dmaengine: virt-dma: add missing MODULE_DESCRIPTION() macro	2024-06-28 13:03:13 +05:30
virt-dma.h	dma: Add lockdep asserts to virt-dma	2024-04-07 17:08:19 +05:30
xgene-dma.c	dmaengine: Fix spelling mistakes	2024-09-02 13:56:01 +05:30