diff options
| author | Rosen Penev <rosenp@gmail.com> | 2026-09-15 00:26:08 -0700 |
|---|---|---|
| committer | Vinod Koul <vkoul@kernel.org> | 2026-09-15 22:59:28 +0530 |
| commit | a8d1f582fae8231bd0cf66164ef140cd410382d4 (patch) | |
| tree | 39c86ec7ae45acc2dcb51fba5776035d9aca39fc /tools/perf/scripts/python | |
| parent | 1ff9bed1b5547259f67e58b03a83eda934d78735 (diff) | |
| download | linux-next-a8d1f582fae8231bd0cf66164ef140cd410382d4.tar.gz linux-next-a8d1f582fae8231bd0cf66164ef140cd410382d4.zip | |
dmaengine: bestcomm: gen_bd: fix out-of-bounds access in PSC parameter lookup
The bcom_psc_params[] array has 6 entries (indices 0-5), but
bcom_psc_gen_bd_rx_init() checked against MPC52xx_PSC_MAXNUM which can
be 12 when CONFIG_PPC_MPC512x is set, allowing indices 6-11 to pass
and read past the array. The tx init function had no bounds check at
all.
A malformed device tree with a large cell-index could therefore trigger
an out-of-bounds read. The garbage initiator and ipr values would then
be used for MMIO writes via out_8(&bcom_eng->regs->ipr[...], ...),
potentially causing out-of-bounds MMIO accesses.
Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260915072608.57887-1-rosenp@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions