diff options
| author | Rosen Penev <rosenp@gmail.com> | 2026-08-19 20:16:54 -0700 |
|---|---|---|
| committer | Vinod Koul <vkoul@kernel.org> | 2026-09-10 19:16:57 +0530 |
| commit | 26d48e9fb6997f4026dd86daecf8d2c12258f698 (patch) | |
| tree | 523f44a0624bfa667ccdbe0d1741d2fefd68fd1e | |
| parent | dd27c3f4d6108556b74b5f3f4d1d885269e7ffa3 (diff) | |
| download | linux-next-26d48e9fb6997f4026dd86daecf8d2c12258f698.tar.gz linux-next-26d48e9fb6997f4026dd86daecf8d2c12258f698.zip | |
dmaengine: fsl_raid: zero CF descriptor pool allocations
The compound frame descriptors and embedded CDBs are allocated from the
cf_desc_pool with dma_pool_alloc(), which does not zero the memory. Only
cdb32, the gfm coefficients and the frame address/length fields are
programmed; the dpi_dest_spec/dpi_src_spec fields in the CDBs and the
rbro32 field of each frame are left uninitialized. The hardware reads
the whole block (frame 0 length is sizeof(struct fsl_re_xor_cdb) or
sizeof(struct fsl_re_pq_cdb)), so uninitialized heap contents are
exposed to the device on each new descriptor.
Use dma_pool_zalloc() in both fsl_re_chan_alloc_desc() and
fsl_re_alloc_chan_resources() so the descriptor and CDB memory is
zeroed before it is handed to the RAID engine.
Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
Assisted-by: opencode:deepseek-v4-flash-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260820031654.28450-1-rosenp@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
| -rw-r--r-- | drivers/dma/fsl_raid.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c index e698c40b2ebc..befb4bb69d54 100644 --- a/drivers/dma/fsl_raid.c +++ b/drivers/dma/fsl_raid.c @@ -306,8 +306,8 @@ static struct fsl_re_desc *fsl_re_chan_alloc_desc(struct fsl_re_chan *re_chan, if (!desc) return NULL; - cf = dma_pool_alloc(re_chan->re_dev->cf_desc_pool, GFP_NOWAIT, - &paddr); + cf = dma_pool_zalloc(re_chan->re_dev->cf_desc_pool, GFP_NOWAIT, + &paddr); if (!cf) { kfree(desc); return NULL; @@ -595,8 +595,8 @@ static int fsl_re_alloc_chan_resources(struct dma_chan *chan) if (!desc) break; - cf = dma_pool_alloc(re_chan->re_dev->cf_desc_pool, GFP_KERNEL, - &paddr); + cf = dma_pool_zalloc(re_chan->re_dev->cf_desc_pool, GFP_KERNEL, + &paddr); if (!cf) { kfree(desc); break; |