linux-kernel - Re: [PATCHv2] dmaengine: ti: edma: Fix memory allocation size for queue_priority

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <762f7869-3c8b-44c3-a4f9-bf0d443673de@wanadoo.fr>
Date: Mon, 8 Sep 2025 21:01:50 +0200
From: Christophe JAILLET <christophe.jaillet@...adoo.fr>
To: Anders Roxell <anders.roxell@...aro.org>, peter.ujfalusi@...il.com,
 vkoul@...nel.org, nathan@...nel.org
Cc: dmaengine@...r.kernel.org, linux-kernel@...r.kernel.org,
 llvm@...ts.linux.dev, dan.carpenter@...aro.org, arnd@...db.de,
 benjamin.copeland@...aro.org
Subject: Re: [PATCHv2] dmaengine: ti: edma: Fix memory allocation size for
 queue_priority_map

Le 30/08/2025 à 11:49, Anders Roxell a écrit :
> Fix a critical memory allocation bug in edma_setup_from_hw() where
> queue_priority_map was allocated with insufficient memory. The code
> declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8),
> but allocated memory using sizeof(s8) instead of the correct size.
> 
> This caused out-of-bounds memory writes when accessing:
>    queue_priority_map[i][0] = i;
>    queue_priority_map[i][1] = i;
> 
> The bug manifested as kernel crashes with "Oops - undefined instruction"
> on ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the
> memory corruption triggered kernel hardening features on Clang.
> 
> Change the allocation to use sizeof(*queue_priority_map) which
> automatically gets the correct size for the 2D array structure.
> 
> Fixes: 2b6b3b742019 ("ARM/dmaengine: edma: Merge the two drivers under drivers/dma/")
> Signed-off-by: Anders Roxell <anders.roxell@...aro.org>
> ---
>   drivers/dma/ti/edma.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
> index 3ed406f08c44..552be71db6c4 100644
> --- a/drivers/dma/ti/edma.c
> +++ b/drivers/dma/ti/edma.c
> @@ -2064,8 +2064,8 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
>   	 * priority. So Q0 is the highest priority queue and the last queue has
>   	 * the lowest priority.
>   	 */
> -	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
> -					  GFP_KERNEL);
> +	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1,
> +					  sizeof(*queue_priority_map), GFP_KERNEL);
>   	if (!queue_priority_map)
>   		return -ENOMEM;
>   

Hi,

for what it worth:
Acked-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>

and for the records:
  
https://lore.kernel.org/all/8c95c485be294e64457606089a2a56e68e2ebd1a.1653153959.git.christophe.jaillet@wanadoo.fr/

;-)

IMHO, the applied solution is cleaner than mine.

Only the Fixes tag could be more relevant (because, the issue is older 
than 2b6b3b742019), but I don't think it will make any difference.

CJ