Re: [PATCH] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[Dan Carpenter]

On Thu, Jul 02, 2026 at 03:43:29PM +0200, Christian Taedcke via B4 Relay wrote:
> From: Christian Taedcke <christian.taedcke@xxxxxxxxxxxxxxx>
> 
> When one irq is used for errors and each channel gets a dedicated irq,
> the total number of irqs is num_channels + 1. If the error irq is not
> the last entry in irqbuf[] but an earlier one, the loop assigning
> per-channel irqs terminates one iteration too early and the last
> channel is left without an irq.
> 
> Iterate over all collected irqs instead of num_channels so the
> error-irq skip does not shorten the effective channel count.
> 
> Fixes: 188c6ba1dd92 ("dmaengine: nbpfaxi: Fix memory corruption in probe()")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Christian Taedcke <christian.taedcke@xxxxxxxxxxxxxxx>
> ---
>  drivers/dma/nbpfaxi.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
> index 05d7321629cc..74ff7bd979e2 100644
> --- a/drivers/dma/nbpfaxi.c
> +++ b/drivers/dma/nbpfaxi.c
> @@ -1374,7 +1374,7 @@ static int nbpf_probe(struct platform_device *pdev)
>  		if (irqs == num_channels + 1) {
>  			struct nbpf_channel *chan;
>  
> -			for (i = 0, chan = nbpf->chan; i < num_channels;
> +			for (i = 0, chan = nbpf->chan; i < irqs;
>  			     i++, chan++) {
>  				/* Skip the error IRQ */
>  				if (irqbuf[i] == eirq)
> 
> ---

Ah.  Thanks.  I feel like it would make sense to change the other
condition as well to:

-                       for (i = 0, chan = nbpf->chan; i < num_channels;
+                       for (i = 0, chan = nbpf->chan; i < irqs;
                             i++, chan++) {
                                /* Skip the error IRQ */
                                if (irqbuf[i] == eirq)
                                        i++;
-                               if (i >= ARRAY_SIZE(irqbuf))
+                               if (i >= num_channels)
                                        return -EINVAL;
                                chan->irq = irqbuf[i];

If we don't find the error IRQ then it would be possible to go out of
bounds of the chan->irq.  It's not likely to happen in real life but it
sort of makes the code make more sense?

regards,
dan carpenter