diff options
| author | Baineng Shou <shoubaineng@gmail.com> | 2026-09-10 10:16:52 +0800 |
|---|---|---|
| committer | Vinod Koul <vkoul@kernel.org> | 2026-09-15 21:57:40 +0530 |
| commit | 075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47 (patch) | |
| tree | 6a9af6892364e00aa0f01b96017c8d8e74c92735 /drivers | |
| parent | 7ed1e3070c9b4bbd67d5519e14711038dd53ab13 (diff) | |
| download | linux-stable-075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47.tar.gz linux-stable-075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47.zip | |
dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist
putting each entry into 'sg', but the entry length is read from 'sgl'
(the list head) instead of 'sg' (the current entry):
for_each_sg(sgl, sg, sg_len, i) {
addr = sg_dma_address(sg);
avail = sg_dma_len(sgl); /* should be 'sg' */
Consequently 'avail' is always the length of the first entry. For
multi-sg lists this causes out-of-bounds reads when a later entry is
shorter than the first, and silent data loss when it is longer.
Single-sg or uniformly-sized lists happen to mask the issue.
Fixes: c8acd6aa6bed3 ("dmaengine: mmp-pdma support")
Signed-off-by: Baineng Shou <shoubaineng@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260910021652.1296640-1-shoubaineng@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/dma/mmp_pdma.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c index 78e3e07e6..ed5207378 100644 --- a/drivers/dma/mmp_pdma.c +++ b/drivers/dma/mmp_pdma.c @@ -712,7 +712,7 @@ mmp_pdma_prep_slave_sg(struct dma_chan *dchan, struct scatterlist *sgl, for_each_sg(sgl, sg, sg_len, i) { addr = sg_dma_address(sg); - avail = sg_dma_len(sgl); + avail = sg_dma_len(sg); do { len = min_t(size_t, avail, PDMA_MAX_DESC_BYTES); |