[PATCHv2 0/2] dmaengine: idma64: descriptor allocation and length limit fixes

Rosen Penev <[email protected]>
Newsgroups org.kernel.vger.linux-hardening,org.kernel.vger.dmaengine,org.kernel.vger.linux-kernel
Message-ID <[email protected]>
This small series cleans up the idma64 descriptor allocation and fixes a
long-standing truncation bug in idma64_prep_slave_sg().

Patch 1 replaces the open-coded two-stage allocation in
idma64_alloc_desc() with kzalloc_flex() using a flexible array member
for the hardware descriptor list, annotated with __counted_by for extra
runtime bounds checking. The now-redundant helper is removed.

Patch 2 addresses the hardware limit. The iDMA 64-bit CTL_HI BLOCK_TS
field is only 17 bits (IDMA64C_CTLH_BLOCK_TS_MASK = 0x1ffff), so when a
scatterlist entry exceeds that size the driver would silently truncate
the transfer length. Use sg_nents_for_dma() to size the descriptor ring
after splitting oversized entries, and iterate the new per-chunk loop so
each hardware descriptor stays within the field.

Rosen Penev (2):

Rosen Penev (2):
  dmaengine: idma64: use kzalloc_flex
  dmaengine: idma64: use sg_nents_for_dma to respect hardware descriptor
    length limit

v2: add second patch

 drivers/dma/idma64.c | 70 ++++++++++++++++++++------------------------
 drivers/dma/idma64.h |  7 +++--
 2 files changed, 36 insertions(+), 41 deletions(-)

Changes since v1:
- (fill in changes here)

-- 
2.55.0
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.