Re: [PATCHv4] dmaengine: bestcomm: gen_bd: fix out-of-bounds access in PSC parameter lookup

[Vinod Koul]

On Tue, 15 Sep 2026 00:26:08 -0700, Rosen Penev wrote:
> The bcom_psc_params[] array has 6 entries (indices 0-5), but
> bcom_psc_gen_bd_rx_init() checked against MPC52xx_PSC_MAXNUM which can
> be 12 when CONFIG_PPC_MPC512x is set, allowing indices 6-11 to pass
> and read past the array. The tx init function had no bounds check at
> all.
> 
> A malformed device tree with a large cell-index could therefore trigger
> an out-of-bounds read. The garbage initiator and ipr values would then
> be used for MMIO writes via out_8(&bcom_eng->regs->ipr[...], ...),
> potentially causing out-of-bounds MMIO accesses.
> 
> [...]

Applied, thanks!

[1/1] dmaengine: bestcomm: gen_bd: fix out-of-bounds access in PSC parameter lookup
      commit: a8d1f582fae8231bd0cf66164ef140cd410382d4

Best regards,
-- 
~Vinod