On Tue, 01 Jul 2025 17:31:40 -0500, Dan Carpenter wrote:
> The nbpf->chan[] array is allocated earlier in the nbpf_probe() function
> and it has "num_channels" elements. These three loops iterate one
> element farther than they should and corrupt memory.
>
> The changes to the second loop are more involved. In this case, we're
> copying data from the irqbuf[] array into the nbpf->chan[] array. If
> the data in irqbuf[i] is the error IRQ then we skip it, so the iterators
> are not in sync. I added a check to ensure that we don't go beyond the
> end of the irqbuf[] array. I'm pretty sure this can't happen, but it
> seemed harmless to add a check.
>
> [...]
Applied, thanks!
[1/1] dmaengine: nbpfaxi: Fix memory corruption in probe()
commit: 188c6ba1dd925849c5d94885c8bbdeb0b3dcf510
Best regards,
--
~Vinod
