Files
openwrt/target/linux/bcm27xx/patches-6.12/950-0451-dw-axi-dmac-platform-Avoid-trampling-with-zero-lengt.patch
T
Shiji Yang 9cf794cff1 kernel: bump 6.12 to 6.12.91
Changelog: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.91

Remove upstreamed patches:
- airoha/patches-6.12/017-v6.13-net-airoha-Implement-BQL-support.patch[1]
- airoha/patches-6.12/138-v7.1-net-airoha-Add-missing-RX_CPU_IDX-configuration-in-a.patch[2]
- airoha/patches-6.12/149-v7.1-net-airoha-Move-ndesc-initialization-at-end-of-airoh.patch[3]
- generic/backport-6.12/940-v7.1-net-dsa-realtek-rtl8365mb-fix-mode-mask-calculation.patch[5]

Manually rebased patches:
- airoha/patches-6.12/048-01-v6.15-net-airoha-Move-airoha_eth-driver-in-a-dedicated-fol.patch[1]
- ath79/patches-6.12/800-leds-add-reset-controller-based-driver.patch[4]
- bcm27xx/patches-6.12/950-0122-bcmgenet-Better-coalescing-parameter-defaults.patch[6]

We also backported four patches to fix perf tool regression:
- generic/backport-6.12/216-01-revert-perf-cgroup-update-metric-leader-in-evlist__e.patch
- generic/backport-6.12/216-02-revert-perf-tool_pmu-fix-aggregation-on-duration_tim.patch
- generic/backport-6.12/216-03-revert-perf-python-add-parse_events-function.patch
- generic/backport-6.12/216-04-revert-perf-tool_pmu-factor-tool-events-into-their-o.patch

All other patches are automatically refreshed.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.12.91&id=ca24fcac1daaa5e8a667981d81986a3eb4b9fb04
[2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.12.91&id=f00037a99bc2332ef59dc85298b98b20af165904
[3] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.12.91&id=d36be272adda7f313e39dd118086955d993bf6a7
[4] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.12.91&id=07d3611389ba7d78b80ea360a42ce32ab2521fbc
[5] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.12.91&id=3354d6c62fd4baa7b32cbd80cc5a8aa3f2bd0656
[6] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.12.91&id=b84351dcc359667bc952131c1424b692ec83dce2

Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23444
(cherry picked from commit 8f638f9366)
Link: https://github.com/openwrt/openwrt/pull/23538
[Adapted to patches in 25.12]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-27 12:38:31 +02:00

34 lines
1.1 KiB
Diff

From 1da919da52eb90ac5eb1e5060ab5358a4ac8385e Mon Sep 17 00:00:00 2001
From: popcornmix <popcornmix@gmail.com>
Date: Tue, 23 Apr 2024 09:51:36 +0100
Subject: [PATCH] dw-axi-dmac-platform: Avoid trampling with zero length buffer
This code:
for_each_sg(sgl, sg, sg_len, i)
num_sgs += DIV_ROUND_UP(sg_dma_len(sg), axi_block_len);
determines how many hw_desc are allocated.
If sg_dma_len(sg)=0 we don't allocate for this sgl.
However in the next loop, we will increment loop
for this case, and loop gets higher than num_sgs
and we trample memory.
Signed-off-by: Dom Cobley <popcornmix@gmail.com>
---
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
@@ -961,6 +961,9 @@ dw_axi_dma_chan_prep_slave_sg(struct dma
mem = sg_dma_address(sg);
len = sg_dma_len(sg);
num_segments = DIV_ROUND_UP(sg_dma_len(sg), axi_block_len);
+ if (!num_segments)
+ continue;
+
segment_len = DIV_ROUND_UP(sg_dma_len(sg), num_segments);
do {