Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

dmaengine: stm32-dma3: Set lli_size after allocation

With the new __counted_by annotation, the "lli_size" variable needs to
valid for accesses to the "lli" array. This requirement is not met in
stm32_dma3_chan_desc_alloc(), since "lli_size" starts at "0", so "lli"
index "0" will not be considered valid during the initialization for loop.

Fix this by setting lli_size immediately after allocation (similar to
how this is handled in stm32_mdma_alloc_desc() for the node/count
relationship).

Fixes: f561ec8b2b33 ("dmaengine: Add STM32 DMA3 support")
Signed-off-by: Kees Cook <kees@kernel.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20240716213830.work.951-kees@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>

authored by

Kees Cook and committed by
Vinod Koul
b53b8319 5e5c793c

+1 -1
+1 -1
drivers/dma/stm32/stm32-dma3.c
··· 403 403 swdesc = kzalloc(struct_size(swdesc, lli, count), GFP_NOWAIT); 404 404 if (!swdesc) 405 405 return NULL; 406 + swdesc->lli_size = count; 406 407 407 408 for (i = 0; i < count; i++) { 408 409 swdesc->lli[i].hwdesc = dma_pool_zalloc(chan->lli_pool, GFP_NOWAIT, ··· 411 410 if (!swdesc->lli[i].hwdesc) 412 411 goto err_pool_free; 413 412 } 414 - swdesc->lli_size = count; 415 413 swdesc->ccr = 0; 416 414 417 415 /* Set LL base address */