linux-kernel - [PATCH v2 1/1] dmaengine: dw-axi-dmac: fix snps,axi-max-burst-len settings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20241202045547.9818-1-fido_max@inbox.ru>
Date: Mon,  2 Dec 2024 07:55:47 +0300
From: Maxim Kochetkov <fido_max@...ox.ru>
To: Eugeniy.Paltsev@...opsys.com,
	vkoul@...nel.org,
	pandith.n@...el.com,
	dmaengine@...r.kernel.org
Cc: linux-kernel@...r.kernel.org,
	kris.pan@...el.com,
	Maxim Kochetkov <fido_max@...ox.ru>
Subject: [PATCH v2 1/1] dmaengine: dw-axi-dmac: fix snps,axi-max-burst-len settings

axi_rw_burst_len allowed values range is 1..256. Then this value
goes to ARLEN/AWLEN 8-bit fields of lli->ctl_hi. So writing 256
leads to overflow and overwrites another fields in LLI. More over
ARLEN/AWLEN values are zero based (0 is 1, 255 is 256).

Fixes: c454d16a7d5a ("dmaengine: dw-axi-dmac: Burst length settings")
Signed-off-by: Maxim Kochetkov <fido_max@...ox.ru>
---
 drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
index b23536645ff7..3454c98f6c0e 100644
--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
@@ -1437,7 +1437,7 @@ static int parse_device_properties(struct axi_dma_chip *chip)
 			return -EINVAL;
 
 		chip->dw->hdata->restrict_axi_burst_len = true;
-		chip->dw->hdata->axi_rw_burst_len = tmp;
+		chip->dw->hdata->axi_rw_burst_len = tmp - 1;
 	}
 
 	return 0;
@@ -1550,7 +1550,9 @@ static int dw_probe(struct platform_device *pdev)
 	dma_cap_set(DMA_CYCLIC, dw->dma.cap_mask);
 
 	/* DMA capabilities */
-	dw->dma.max_burst = hdata->axi_rw_burst_len;
+	if (hdata->restrict_axi_burst_len)
+		dw->dma.max_burst = hdata->axi_rw_burst_len + 1;
+
 	dw->dma.src_addr_widths = AXI_DMA_BUSWIDTHS;
 	dw->dma.dst_addr_widths = AXI_DMA_BUSWIDTHS;
 	dw->dma.directions = BIT(DMA_MEM_TO_MEM);
-- 
2.45.2