dmaengine: xilinx_dma: check for invalid vdma interleaved parameters

The VDMA HSIZE register (corresponding to sgl[0].size) is only 16bit wide /
the VSIZE register (corresponding to numf) is only 13bit wide, so reject
requests not fitting within that rather than silently transferring too
little data.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://lore.kernel.org/r/20240105105956.1370220-1-peter@korsgaard.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>

diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index e40696f6f8647de7f3d869be1684891725f903d7..5eb51ae93e89d0b2aed30dc470b31f198e078912 100644 (file)
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -112,7 +112,9 @@
 
 /* Register Direct Mode Registers */
 #define XILINX_DMA_REG_VSIZE                   0x0000
+#define XILINX_DMA_VSIZE_MASK                  GENMASK(12, 0)
 #define XILINX_DMA_REG_HSIZE                   0x0004
+#define XILINX_DMA_HSIZE_MASK                  GENMASK(15, 0)
 
 #define XILINX_DMA_REG_FRMDLY_STRIDE           0x0008
 #define XILINX_DMA_FRMDLY_STRIDE_FRMDLY_SHIFT  24
@@ -2050,6 +2052,10 @@ xilinx_vdma_dma_prep_interleaved(struct dma_chan *dchan,
        if (!xt->numf || !xt->sgl[0].size)
                return NULL;
 
+       if (xt->numf & ~XILINX_DMA_VSIZE_MASK ||
+           xt->sgl[0].size & ~XILINX_DMA_HSIZE_MASK)
+               return NULL;
+
        if (xt->frame_size != 1)
                return NULL;