[PATCH v3] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[PATCH v3] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[Christian Taedcke via B4 Relay]

From: Christian Taedcke <christian.taedcke@weidmueller.com>

When one irq is used for errors and each channel gets a dedicated irq,
the total number of irqs is num_channels + 1. If the error irq is not
the last entry in irqbuf[] but an earlier one, the loop assigning
per-channel irqs terminates one iteration too early and the last
channel is left without an irq.

Iterate over all collected irqs instead of num_channels so the
error-irq skip does not shorten the effective channel count.

Fixes: 188c6ba1dd92 ("dmaengine: nbpfaxi: Fix memory corruption in probe()")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Taedcke <christian.taedcke@weidmueller.com>
---
Changes in v3:
- Guard against out-of-bound writes to chan in case of an invalid eirq.
- Link to v2: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v2-1-e6d6b178a278@weidmueller.com

Changes in v2:
- Advance chan only when assigning a real irq to fix out-of-bounds
  memory access.
- Remove now redundant ARRAY_SIZE(irqbuf) check.
- Link to v1: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v1-1-fd8ea8830cea@weidmueller.com

To: christian.taedcke-oss@weidmueller.com
To: Vinod Koul <vkoul@kernel.org>
To: Frank Li <Frank.Li@kernel.org>
To: Dan Carpenter <error27@gmail.com>
Cc: dmaengine@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
---
 drivers/dma/nbpfaxi.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
index 05d7321629cc..b1f06f0bd0d5 100644
--- a/drivers/dma/nbpfaxi.c
+++ b/drivers/dma/nbpfaxi.c
@@ -1374,14 +1374,14 @@ static int nbpf_probe(struct platform_device *pdev)
 		if (irqs == num_channels + 1) {
 			struct nbpf_channel *chan;
 
-			for (i = 0, chan = nbpf->chan; i < num_channels;
-			     i++, chan++) {
+			for (i = 0, chan = nbpf->chan; i < irqs; i++) {
 				/* Skip the error IRQ */
 				if (irqbuf[i] == eirq)
-					i++;
-				if (i >= ARRAY_SIZE(irqbuf))
+					continue;
+				if (chan >= nbpf->chan + num_channels)
 					return -EINVAL;
 				chan->irq = irqbuf[i];
+				chan++;
 			}
 		} else {
 			/* 2 IRQs and more than one channel */

---
base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
change-id: 20260702-upstreaming-nbpfaxi-v1-0364e355af85

Best regards,
--  
Christian Taedcke <christian.taedcke@weidmueller.com>

Re: [PATCH v3] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[Dan Carpenter]

On Fri, Jul 03, 2026 at 09:56:12AM +0200, Christian Taedcke via B4 Relay wrote:
> From: Christian Taedcke <christian.taedcke@weidmueller.com>
> 
> When one irq is used for errors and each channel gets a dedicated irq,
> the total number of irqs is num_channels + 1. If the error irq is not
> the last entry in irqbuf[] but an earlier one, the loop assigning
> per-channel irqs terminates one iteration too early and the last
> channel is left without an irq.
> 
> Iterate over all collected irqs instead of num_channels so the
> error-irq skip does not shorten the effective channel count.
> 
> Fixes: 188c6ba1dd92 ("dmaengine: nbpfaxi: Fix memory corruption in probe()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Taedcke <christian.taedcke@weidmueller.com>
> ---
> Changes in v3:
> - Guard against out-of-bound writes to chan in case of an invalid eirq.
> - Link to v2: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v2-1-e6d6b178a278@weidmueller.com
> 
> Changes in v2:
> - Advance chan only when assigning a real irq to fix out-of-bounds
>   memory access.
> - Remove now redundant ARRAY_SIZE(irqbuf) check.
> - Link to v1: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v1-1-fd8ea8830cea@weidmueller.com
> 
> To: christian.taedcke-oss@weidmueller.com
> To: Vinod Koul <vkoul@kernel.org>
> To: Frank Li <Frank.Li@kernel.org>
> To: Dan Carpenter <error27@gmail.com>
> Cc: dmaengine@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> ---
>  drivers/dma/nbpfaxi.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
> index 05d7321629cc..b1f06f0bd0d5 100644
> --- a/drivers/dma/nbpfaxi.c
> +++ b/drivers/dma/nbpfaxi.c
> @@ -1374,14 +1374,14 @@ static int nbpf_probe(struct platform_device *pdev)
>  		if (irqs == num_channels + 1) {
>  			struct nbpf_channel *chan;
>  
> -			for (i = 0, chan = nbpf->chan; i < num_channels;
> -			     i++, chan++) {
> +			for (i = 0, chan = nbpf->chan; i < irqs; i++) {
>  				/* Skip the error IRQ */
>  				if (irqbuf[i] == eirq)
> -					i++;
> -				if (i >= ARRAY_SIZE(irqbuf))
> +					continue;
> +				if (chan >= nbpf->chan + num_channels)

Prefer my check, but sure...

It's pretty annoying that sashiko bot doesn't CC the CC list.

regards,
dan carpenter

>  					return -EINVAL;
>  				chan->irq = irqbuf[i];
> +				chan++;
>  			}
>  		} else {
>  			/* 2 IRQs and more than one channel */

Re: [PATCH v3] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[Taedcke, Christian]

On 7/9/2026 12:38 PM, Dan Carpenter wrote:
> On Fri, Jul 03, 2026 at 09:56:12AM +0200, Christian Taedcke via B4 Relay wrote:
>> From: Christian Taedcke <christian.taedcke@weidmueller.com>
>>
>> When one irq is used for errors and each channel gets a dedicated irq,
>> the total number of irqs is num_channels + 1. If the error irq is not
>> the last entry in irqbuf[] but an earlier one, the loop assigning
>> per-channel irqs terminates one iteration too early and the last
>> channel is left without an irq.
>>
>> Iterate over all collected irqs instead of num_channels so the
>> error-irq skip does not shorten the effective channel count.
>>
>> Fixes: 188c6ba1dd92 ("dmaengine: nbpfaxi: Fix memory corruption in probe()")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Christian Taedcke <christian.taedcke@weidmueller.com>
>> ---
>> Changes in v3:
>> - Guard against out-of-bound writes to chan in case of an invalid eirq.
>> - Link to v2: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v2-1-e6d6b178a278@weidmueller.com
>>
>> Changes in v2:
>> - Advance chan only when assigning a real irq to fix out-of-bounds
>>   memory access.
>> - Remove now redundant ARRAY_SIZE(irqbuf) check.
>> - Link to v1: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v1-1-fd8ea8830cea@weidmueller.com
>>
>> To: christian.taedcke-oss@weidmueller.com
>> To: Vinod Koul <vkoul@kernel.org>
>> To: Frank Li <Frank.Li@kernel.org>
>> To: Dan Carpenter <error27@gmail.com>
>> Cc: dmaengine@vger.kernel.org
>> Cc: linux-kernel@vger.kernel.org
>> ---
>>  drivers/dma/nbpfaxi.c | 8 ++++----
>>  1 file changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
>> index 05d7321629cc..b1f06f0bd0d5 100644
>> --- a/drivers/dma/nbpfaxi.c
>> +++ b/drivers/dma/nbpfaxi.c
>> @@ -1374,14 +1374,14 @@ static int nbpf_probe(struct platform_device *pdev)
>>  		if (irqs == num_channels + 1) {
>>  			struct nbpf_channel *chan;
>>  
>> -			for (i = 0, chan = nbpf->chan; i < num_channels;
>> -			     i++, chan++) {
>> +			for (i = 0, chan = nbpf->chan; i < irqs; i++) {
>>  				/* Skip the error IRQ */
>>  				if (irqbuf[i] == eirq)
>> -					i++;
>> -				if (i >= ARRAY_SIZE(irqbuf))
>> +					continue;
>> +				if (chan >= nbpf->chan + num_channels)
> 
> Prefer my check, but sure...

Thank you for your review, i send a new version where i try to use your preferred check.
> 
> It's pretty annoying that sashiko bot doesn't CC the CC list.

Is there anything i can do to improve this? Should i reply to the sashiko bot comments and also send this to the CC list?

> 
> regards,
> dan carpenter
> 
>>  					return -EINVAL;
>>  				chan->irq = irqbuf[i];
>> +				chan++;
>>  			}
>>  		} else {
>>  			/* 2 IRQs and more than one channel */
> 

Regards,
Christian

Re: [PATCH v3] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[Dan Carpenter]

On Tue, Jul 14, 2026 at 09:44:22AM +0200, Taedcke, Christian wrote:
> 
> 
> On 7/9/2026 12:38 PM, Dan Carpenter wrote:
> > On Fri, Jul 03, 2026 at 09:56:12AM +0200, Christian Taedcke via B4 Relay wrote:
> >> From: Christian Taedcke <christian.taedcke@weidmueller.com>
> >>
> >> When one irq is used for errors and each channel gets a dedicated irq,
> >> the total number of irqs is num_channels + 1. If the error irq is not
> >> the last entry in irqbuf[] but an earlier one, the loop assigning
> >> per-channel irqs terminates one iteration too early and the last
> >> channel is left without an irq.
> >>
> >> Iterate over all collected irqs instead of num_channels so the
> >> error-irq skip does not shorten the effective channel count.
> >>
> >> Fixes: 188c6ba1dd92 ("dmaengine: nbpfaxi: Fix memory corruption in probe()")
> >> Cc: stable@vger.kernel.org
> >> Signed-off-by: Christian Taedcke <christian.taedcke@weidmueller.com>
> >> ---
> >> Changes in v3:
> >> - Guard against out-of-bound writes to chan in case of an invalid eirq.
> >> - Link to v2: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v2-1-e6d6b178a278@weidmueller.com
> >>
> >> Changes in v2:
> >> - Advance chan only when assigning a real irq to fix out-of-bounds
> >>   memory access.
> >> - Remove now redundant ARRAY_SIZE(irqbuf) check.
> >> - Link to v1: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v1-1-fd8ea8830cea@weidmueller.com
> >>
> >> To: christian.taedcke-oss@weidmueller.com
> >> To: Vinod Koul <vkoul@kernel.org>
> >> To: Frank Li <Frank.Li@kernel.org>
> >> To: Dan Carpenter <error27@gmail.com>
> >> Cc: dmaengine@vger.kernel.org
> >> Cc: linux-kernel@vger.kernel.org
> >> ---
> >>  drivers/dma/nbpfaxi.c | 8 ++++----
> >>  1 file changed, 4 insertions(+), 4 deletions(-)
> >>
> >> diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
> >> index 05d7321629cc..b1f06f0bd0d5 100644
> >> --- a/drivers/dma/nbpfaxi.c
> >> +++ b/drivers/dma/nbpfaxi.c
> >> @@ -1374,14 +1374,14 @@ static int nbpf_probe(struct platform_device *pdev)
> >>  		if (irqs == num_channels + 1) {
> >>  			struct nbpf_channel *chan;
> >>  
> >> -			for (i = 0, chan = nbpf->chan; i < num_channels;
> >> -			     i++, chan++) {
> >> +			for (i = 0, chan = nbpf->chan; i < irqs; i++) {
> >>  				/* Skip the error IRQ */
> >>  				if (irqbuf[i] == eirq)
> >> -					i++;
> >> -				if (i >= ARRAY_SIZE(irqbuf))
> >> +					continue;
> >> +				if (chan >= nbpf->chan + num_channels)
> > 
> > Prefer my check, but sure...
> 
> Thank you for your review, i send a new version where i try to use your preferred check.
> > 
> > It's pretty annoying that sashiko bot doesn't CC the CC list.
> 
> Is there anything i can do to improve this? Should i reply to the sashiko bot comments and also send this to the CC list?
> 

Not at all.  Just random grumbling.

regards,
dan carpenter

Re: [PATCH v3] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[Taedcke, Christian]

On 7/9/2026 12:38 PM, Dan Carpenter wrote:
> On Fri, Jul 03, 2026 at 09:56:12AM +0200, Christian Taedcke via B4 Relay wrote:
>> From: Christian Taedcke <christian.taedcke@weidmueller.com>
>>
>> When one irq is used for errors and each channel gets a dedicated irq,
>> the total number of irqs is num_channels + 1. If the error irq is not
>> the last entry in irqbuf[] but an earlier one, the loop assigning
>> per-channel irqs terminates one iteration too early and the last
>> channel is left without an irq.
>>
>> Iterate over all collected irqs instead of num_channels so the
>> error-irq skip does not shorten the effective channel count.
>>
>> Fixes: 188c6ba1dd92 ("dmaengine: nbpfaxi: Fix memory corruption in probe()")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Christian Taedcke <christian.taedcke@weidmueller.com>
>> ---
>> Changes in v3:
>> - Guard against out-of-bound writes to chan in case of an invalid eirq.
>> - Link to v2: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v2-1-e6d6b178a278@weidmueller.com
>>
>> Changes in v2:
>> - Advance chan only when assigning a real irq to fix out-of-bounds
>>   memory access.
>> - Remove now redundant ARRAY_SIZE(irqbuf) check.
>> - Link to v1: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v1-1-fd8ea8830cea@weidmueller.com
>>
>> To: christian.taedcke-oss@weidmueller.com
>> To: Vinod Koul <vkoul@kernel.org>
>> To: Frank Li <Frank.Li@kernel.org>
>> To: Dan Carpenter <error27@gmail.com>
>> Cc: dmaengine@vger.kernel.org
>> Cc: linux-kernel@vger.kernel.org
>> ---
>>  drivers/dma/nbpfaxi.c | 8 ++++----
>>  1 file changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
>> index 05d7321629cc..b1f06f0bd0d5 100644
>> --- a/drivers/dma/nbpfaxi.c
>> +++ b/drivers/dma/nbpfaxi.c
>> @@ -1374,14 +1374,14 @@ static int nbpf_probe(struct platform_device *pdev)
>>  		if (irqs == num_channels + 1) {
>>  			struct nbpf_channel *chan;
>>  
>> -			for (i = 0, chan = nbpf->chan; i < num_channels;
>> -			     i++, chan++) {
>> +			for (i = 0, chan = nbpf->chan; i < irqs; i++) {
>>  				/* Skip the error IRQ */
>>  				if (irqbuf[i] == eirq)
>> -					i++;
>> -				if (i >= ARRAY_SIZE(irqbuf))
>> +					continue;
>> +				if (chan >= nbpf->chan + num_channels)
> 
> Prefer my check, but sure...

I tested changing the condition back to check for i. But after a few different approaches, i think the check in v3 (chan >= nbpf->chan + num_channels) is more robust.

It handles the following cases well:
1. eirq is the last entry in irqbuf[]
2. eirq is not in irqbuf[] (which is not expected)

This check also makes it clear that the write destination is verified.

-> i would prefer to keep the v3 patch as is.

> 
> It's pretty annoying that sashiko bot doesn't CC the CC list.
> 
> regards,
> dan carpenter
> 
>>  					return -EINVAL;
>>  				chan->irq = irqbuf[i];
>> +				chan++;
>>  			}
>>  		} else {
>>  			/* 2 IRQs and more than one channel */
> 

Regards,
Christian

Re: [PATCH v3] dmaengine: nbpfaxi: Fix setting channel irqs in probe()

[Dan Carpenter]

On Tue, Jul 14, 2026 at 01:58:53PM +0200, Taedcke, Christian wrote:
> 
> 
> On 7/9/2026 12:38 PM, Dan Carpenter wrote:
> > On Fri, Jul 03, 2026 at 09:56:12AM +0200, Christian Taedcke via B4 Relay wrote:
> >> From: Christian Taedcke <christian.taedcke@weidmueller.com>
> >>
> >> When one irq is used for errors and each channel gets a dedicated irq,
> >> the total number of irqs is num_channels + 1. If the error irq is not
> >> the last entry in irqbuf[] but an earlier one, the loop assigning
> >> per-channel irqs terminates one iteration too early and the last
> >> channel is left without an irq.
> >>
> >> Iterate over all collected irqs instead of num_channels so the
> >> error-irq skip does not shorten the effective channel count.
> >>
> >> Fixes: 188c6ba1dd92 ("dmaengine: nbpfaxi: Fix memory corruption in probe()")
> >> Cc: stable@vger.kernel.org
> >> Signed-off-by: Christian Taedcke <christian.taedcke@weidmueller.com>
> >> ---
> >> Changes in v3:
> >> - Guard against out-of-bound writes to chan in case of an invalid eirq.
> >> - Link to v2: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v2-1-e6d6b178a278@weidmueller.com
> >>
> >> Changes in v2:
> >> - Advance chan only when assigning a real irq to fix out-of-bounds
> >>   memory access.
> >> - Remove now redundant ARRAY_SIZE(irqbuf) check.
> >> - Link to v1: https://patch.msgid.link/20260702-upstreaming-nbpfaxi-v1-v1-1-fd8ea8830cea@weidmueller.com
> >>
> >> To: christian.taedcke-oss@weidmueller.com
> >> To: Vinod Koul <vkoul@kernel.org>
> >> To: Frank Li <Frank.Li@kernel.org>
> >> To: Dan Carpenter <error27@gmail.com>
> >> Cc: dmaengine@vger.kernel.org
> >> Cc: linux-kernel@vger.kernel.org
> >> ---
> >>  drivers/dma/nbpfaxi.c | 8 ++++----
> >>  1 file changed, 4 insertions(+), 4 deletions(-)
> >>
> >> diff --git a/drivers/dma/nbpfaxi.c b/drivers/dma/nbpfaxi.c
> >> index 05d7321629cc..b1f06f0bd0d5 100644
> >> --- a/drivers/dma/nbpfaxi.c
> >> +++ b/drivers/dma/nbpfaxi.c
> >> @@ -1374,14 +1374,14 @@ static int nbpf_probe(struct platform_device *pdev)
> >>  		if (irqs == num_channels + 1) {
> >>  			struct nbpf_channel *chan;
> >>  
> >> -			for (i = 0, chan = nbpf->chan; i < num_channels;
> >> -			     i++, chan++) {
> >> +			for (i = 0, chan = nbpf->chan; i < irqs; i++) {
> >>  				/* Skip the error IRQ */
> >>  				if (irqbuf[i] == eirq)
> >> -					i++;
> >> -				if (i >= ARRAY_SIZE(irqbuf))
> >> +					continue;
> >> +				if (chan >= nbpf->chan + num_channels)
> > 
> > Prefer my check, but sure...
> 
> I tested changing the condition back to check for i. But after a few different approaches, i think the check in v3 (chan >= nbpf->chan + num_channels) is more robust.
> 
> It handles the following cases well:
> 1. eirq is the last entry in irqbuf[]
> 2. eirq is not in irqbuf[] (which is not expected)
> 
> This check also makes it clear that the write destination is verified.
> 
> -> i would prefer to keep the v3 patch as is.
> 

Ah, yeah.  You're right.  v3 is good.

Reviewed-by: Dan Carpenter <error27@gmail.com>

regards,
dan carpenter