Commit d7b2df97 authored Jul 12, 2023 by Christophe JAILLET Committed by Greg Kroah-Hartman Aug 16, 2023

dmaengine: mcf-edma: Fix a potential un-allocated memory access

commit 0a46781c89dece85386885a407244ca26e5c1c44 upstream.

When 'mcf_edma' is allocated, some space is allocated for a
flexible array at the end of the struct. 'chans' item are allocated, that is
to say 'pdata->dma_channels'.

Then, this number of item is stored in 'mcf_edma->n_chans'.

A few lines later, if 'mcf_edma->n_chans' is 0, then a default value of 64
is set.

This ends to no space allocated by devm_kzalloc() because chans was 0, but
64 items are read and/or written in some not allocated memory.

Change the logic to define a default value before allocating the memory.

Fixes: e7a3ff92 ("dmaengine: fsl-edma: add ColdFire mcf5441x edma support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/f55d914407c900828f6fad3ea5fa791a5f17b9a4.1685172449.git.christophe.jaillet@wanadoo.fr

Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent e913d894

drivers/dma/mcf-edma.c

+7 −6

Original line number	Diff line number	Diff line
		@@ -191,7 +191,13 @@ static int mcf_edma_probe(struct platform_device *pdev)
		return -EINVAL;
		}

		if (!pdata->dma_channels) {
		dev_info(&pdev->dev, "setting default channel number to 64");
		chans = 64;
		} else {
		chans = pdata->dma_channels;
		}

		len = sizeof(mcf_edma) + sizeof(mcf_chan) * chans;
		mcf_edma = devm_kzalloc(&pdev->dev, len, GFP_KERNEL);
		if (!mcf_edma)
		@@ -203,11 +209,6 @@ static int mcf_edma_probe(struct platform_device *pdev)
		mcf_edma->drvdata = &mcf_data;
		mcf_edma->big_endian = 1;

		if (!mcf_edma->n_chans) {
		dev_info(&pdev->dev, "setting default channel number to 64");
		mcf_edma->n_chans = 64;
		}

		mutex_init(&mcf_edma->fsl_edma_mutex);

		res = platform_get_resource(pdev, IORESOURCE_MEM, 0);