diff options
| author | Rosen Penev <rosenp@gmail.com> | 2026-08-19 20:16:54 -0700 |
|---|---|---|
| committer | Vinod Koul <vkoul@kernel.org> | 2026-09-10 19:16:57 +0530 |
| commit | 26d48e9fb6997f4026dd86daecf8d2c12258f698 (patch) | |
| tree | 523f44a0624bfa667ccdbe0d1741d2fefd68fd1e /tools/perf/scripts/python | |
| parent | dd27c3f4d6108556b74b5f3f4d1d885269e7ffa3 (diff) | |
| download | linux-next-26d48e9fb6997f4026dd86daecf8d2c12258f698.tar.gz linux-next-26d48e9fb6997f4026dd86daecf8d2c12258f698.zip | |
dmaengine: fsl_raid: zero CF descriptor pool allocations
The compound frame descriptors and embedded CDBs are allocated from the
cf_desc_pool with dma_pool_alloc(), which does not zero the memory. Only
cdb32, the gfm coefficients and the frame address/length fields are
programmed; the dpi_dest_spec/dpi_src_spec fields in the CDBs and the
rbro32 field of each frame are left uninitialized. The hardware reads
the whole block (frame 0 length is sizeof(struct fsl_re_xor_cdb) or
sizeof(struct fsl_re_pq_cdb)), so uninitialized heap contents are
exposed to the device on each new descriptor.
Use dma_pool_zalloc() in both fsl_re_chan_alloc_desc() and
fsl_re_alloc_chan_resources() so the descriptor and CDB memory is
zeroed before it is handed to the RAID engine.
Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
Assisted-by: opencode:deepseek-v4-flash-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260820031654.28450-1-rosenp@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions