mirror of
https://github.com/torvalds/linux.git
synced 2026-10-07 22:37:45 -04:00
Robin Gong
bd73dfabdd
Illegal memory will be touch if SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3 (41) exceed the size of structure sdma_script_start_addrs(40), thus cause memory corrupt such as slob block header so that kernel trap into while() loop forever in slob_free(). Please refer to below code piece in imx-sdma.c: for (i = 0; i < sdma->script_number; i++) if (addr_arr[i] > 0) saddr_arr[i] = addr_arr[i]; /* memory corrupt here */ That issue was brought by commita572460be9("dmaengine: imx-sdma: Add support for version 3 firmware") because SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3 (38->41 3 scripts added) not align with script number added in sdma_script_start_addrs(2 scripts). Fixes:a572460be9("dmaengine: imx-sdma: Add support for version 3 firmware") Cc: [email protected] Link: https://www.spinics.net/lists/arm-kernel/msg754895.html Signed-off-by: Robin Gong <[email protected]> Reported-by: Jurgen Lambrecht <[email protected]> Link: https://lore.kernel.org/r/[email protected] [vkoul: update the patch title] Signed-off-by: Vinod Koul <[email protected]>