dmaengine: bestcomm: gen_bd: split struct bcom_psc_params from array definition

drivers/dma/bestcomm/gen_bd.c EXPORT_SYMBOL_GPL(bcom_gen_bd_tx_release); · line 273

[Severity: High]
This is a pre-existing issue, but does the bounds check in bcom_psc_gen_bd_rx_init() adequately protect this 6-element array?

drivers/dma/bestcomm/gen_bd.c:bcom_psc_gen_bd_rx_init() {
    if (psc_num >= MPC52xx_PSC_MAXNUM)
        return NULL;

    return bcom_gen_bd_rx_init(queue_len, fifo,
                               bcom_psc_params[psc_num].rx_initiator,
                               bcom_psc_params[psc_num].rx_ipr,
                               maxbufsize);
}

If a multi-platform kernel has CONFIG_PPC_MPC512x enabled, MPC52xx_PSC_MAXNUM evaluates to 12.

Since this array explicitly only contains 6 elements (indices 0 to 5), a cell-index between 6 and 11 from a malformed device tree parsed in mpc5200_audio_dma_create() would bypass the check and read out-of-bounds.

This could cause bcom_gen_bd_rx_init() to write out-of-bounds to the IPR register array.

[Severity: High]
This is also a pre-existing issue, but is there a missing bounds check when using psc_num to index this array in bcom_psc_gen_bd_tx_init()?

drivers/dma/bestcomm/gen_bd.c:bcom_psc_gen_bd_tx_init() {
    ...
    return bcom_gen_bd_tx_init(queue_len, fifo,
                               bcom_psc_params[psc_num].tx_initiator,
                               bcom_psc_params[psc_num].tx_ipr);
}

An unvalidated psc_num from a device tree cell-index parsed in mpc5200_audio_dma_create() could cause an out-of-bounds read here.

The resulting garbage data passed to bcom_gen_bd_tx_init() could then lead to an out-of-bounds write to the IPR register array, potentially causing memory corruption.