Skip to content

Commit f9b8861

Browse files
JIvanVeragregkh
authored andcommitted
nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
Buffer size used in dma allocation and memcpy is wrong. It can lead to undersized DMA buffer access and possible memory corruption. use correct buffer size in dma_alloc_coherent and memcpy. Fixes: 737c0c8 ("nvmem: zynqmp_nvmem: Add support to access efuse") Cc: stable@vger.kernel.org Signed-off-by: Ivan Vera <ivanverasantos@gmail.com> Signed-off-by: Harish Ediga <harish.ediga@amd.com> Signed-off-by: Harsh Jain <h.jain@amd.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260327131645.3025781-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 48b5163 commit f9b8861

1 file changed

Lines changed: 4 additions & 4 deletions

File tree

drivers/nvmem/zynqmp_nvmem.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ static int zynqmp_efuse_access(void *context, unsigned int offset,
6666
dma_addr_t dma_buf;
6767
size_t words = bytes / WORD_INBYTES;
6868
int ret;
69-
int value;
69+
unsigned int value;
7070
char *data;
7171

7272
if (bytes % WORD_INBYTES != 0) {
@@ -80,7 +80,7 @@ static int zynqmp_efuse_access(void *context, unsigned int offset,
8080
}
8181

8282
if (pufflag == 1 && flag == EFUSE_WRITE) {
83-
memcpy(&value, val, bytes);
83+
memcpy(&value, val, sizeof(value));
8484
if ((offset == EFUSE_PUF_START_OFFSET ||
8585
offset == EFUSE_PUF_MID_OFFSET) &&
8686
value & P_USER_0_64_UPPER_MASK) {
@@ -100,7 +100,7 @@ static int zynqmp_efuse_access(void *context, unsigned int offset,
100100
if (!efuse)
101101
return -ENOMEM;
102102

103-
data = dma_alloc_coherent(dev, sizeof(bytes),
103+
data = dma_alloc_coherent(dev, bytes,
104104
&dma_buf, GFP_KERNEL);
105105
if (!data) {
106106
ret = -ENOMEM;
@@ -134,7 +134,7 @@ static int zynqmp_efuse_access(void *context, unsigned int offset,
134134
if (flag == EFUSE_READ)
135135
memcpy(val, data, bytes);
136136
efuse_access_err:
137-
dma_free_coherent(dev, sizeof(bytes),
137+
dma_free_coherent(dev, bytes,
138138
data, dma_buf);
139139
efuse_data_fail:
140140
dma_free_coherent(dev, sizeof(struct xilinx_efuse),

0 commit comments

Comments
 (0)