redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

dmaengine fixes for v4.16-rc7

Browse source 
One small fix for stm32-dmamux fixing buffer overflow.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJat2RrAAoJEHwUBw8lI4NH1ZoQAMled80WTAY6lj1MTcstAfis
 fE47ZAv277RLpmdBCgibjja+9KL0PiQrWdBGryKGnLGEuI3vCZjY9F+H5gaHoOtM
 W6xQ5cEpuOlRDjwvYt1WXDSEJH2IYfoiJx/ATdG063oCDricUte3FTVxQhI//7l8
 2zkVBKtp1qG9Zn3DOTLmjoWTdJ7omGlCZW1KiBJs4lxGR6Hu8ZnmZoiCxp1lpLuM
 CaRcynw9dN9L+Ro9JshE9uaFYY8UTZO/XLYYs/uQn+eCIJVYi6xyQH0HLgELb+NR
 hnnEi+hfujV/mGfhWfWYjQa4/2u0hu9MCmV5ZsWS4jULhfkXcMzFOhzEat9/arRE
 TOUjDjkfBQJeoOnrQebvWf9Bh19AXhmz3/2xFDPQfhbLaaRiZ4muv3ZVEsQRNUnQ
 uxgyAJ36cG9Ft0aMotYey3A3grCxdeex0OdE1oEtSvJmYzTiwaCYUwYWYdiWyab6
 hkpwYFdvyWgmCrac46JFddsajlXPOkYJhS7Rbvdi8grRf22ICQBEeAeP4wCZPwaZ
 KGbZ2R8LerHsnqYuT7/hQTvOArBx41+0ZK6LWvCQ45NCaUIn7994KG1gCoRM+cxm
 /rrZRjoEE5BYtdA//UBs5OM6xYyk3CkTSknRZw7kgYWesA219G8t4ftaOQOhb4QF
 zupV8XpPZbTTh+FbViaN
 =AIMK
 -----END PGP SIGNATURE-----

Merge tag 'dmaengine-fix-4.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/slave-dma

Pull dmaengine fix from Vinod Koul:
 "One small fix for stm32-dmamux fixing buffer overflow"

* tag 'dmaengine-fix-4.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/slave-dma:
  dmaengine: stm32-dmamux: fix a potential buffer overflow
This commit is contained in:
Linus Torvalds 2018-03-25 07:45:10 -10:00
parent d2862360bf 3e4543bf20
commit cb6416592b
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
drivers/dma/stm32-dmamux.c
View file

@ -118,14 +118,15 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec,
spin_lock_irqsave(&dmamux->lock, flags);
mux->chan_id = find_first_zero_bit(dmamux->dma_inuse,
dmamux->dma_requests);
set_bit(mux->chan_id, dmamux->dma_inuse);
spin_unlock_irqrestore(&dmamux->lock, flags);
if (mux->chan_id == dmamux->dma_requests) {
spin_unlock_irqrestore(&dmamux->lock, flags);
dev_err(&pdev->dev, "Run out of free DMA requests\n");
ret = -ENOMEM;
goto error;
goto error_chan_id;
}
set_bit(mux->chan_id, dmamux->dma_inuse);
spin_unlock_irqrestore(&dmamux->lock, flags);
/* Look for DMA Master */
for (i = 1, min = 0, max = dmamux->dma_reqs[i];
@ -173,6 +174,8 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec,
error:
clear_bit(mux->chan_id, dmamux->dma_inuse);
error_chan_id:
kfree(mux);
return ERR_PTR(ret);
}