Re: [PATCHv4] dmaengine: bestcomm: gen_bd: fix out-of-bounds access in PSC parameter lookup
From: sashiko-bot@kernel.org
Date: 2026-09-15 07:37:57
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Low] dmaengine: bestcomm: useless struct declaration mixed with code -- commit b34f7960c5a14d5c07b8bccee4d8da1a3d8c6985 Author: Rosen Penev [off-list ref] dmaengine: bestcomm: gen_bd: fix out-of-bounds access in PSC parameter lookup The bcom_psc_params[] array has 6 entries (indices 0-5), but bcom_psc_gen_bd_rx_init() checked against MPC52xx_PSC_MAXNUM which can be 12 when CONFIG_PPC_MPC512x is set, allowing indices 6-11 to pass and read past the array. The tx init function had no bounds check at all.
quoted hunk ↗ jump to hunk
diff --git a/drivers/dma/bestcomm/gen_bd.c b/drivers/dma/bestcomm/gen_bd.c index 8a24a5cbc2633..43e5bdd6937ec 100644 --- a/drivers/dma/bestcomm/gen_bd.c +++ b/drivers/dma/bestcomm/gen_bd.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -336,6 +336,9 @@ EXPORT_SYMBOL_GPL(bcom_psc_gen_bd_rx_init); struct bcom_task * bcom_psc_gen_bd_tx_init(unsigned psc_num, int queue_len, phys_addr_t fifo) { + if (psc_num >= ARRAY_SIZE(bcom_psc_params)) + return NULL; + struct psc;
[Severity: Low] Is this struct psc; declaration needed here? It appears to be a useless forward declaration that is now awkwardly positioned after an active statement in bcom_psc_gen_bd_tx_init().
return bcom_gen_bd_tx_init(queue_len, fifo, bcom_psc_params[psc_num].tx_initiator,
-- Sashiko AI review · https://sashiko.dev/#/patchset/20260915072608.57887-1-rosenp@gmail.com?part=1