luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ARM: PL08x: fix array overflow in dma_set_runtime_config()

Browse Source 
If maxburst was passed in as zero, we would overflow the burst_sizes[]
array.  Fix this by checking for this condition, and defaulting to
single transfer 'bursts'.

Improve the readability of the loop using a for() loop rather than
a while() loop with the iterator initialized far from the loop.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Acked-by: Linus Walleij <linus.walleij@stericsson.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
This commit is contained in:
Russell King - ARM Linux 2011-01-03 22:30:44 +00:00 committed by Dan Williams
parent e8b5e11df3
commit 4440aacf3a
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/dma/amba-pl08x.c
View File

@ -1207,7 +1207,7 @@ static void dma_set_runtime_config(struct dma_chan *chan,
u32 cctl = 0;
/* Mask out all except src and dst channel */
u32 ccfg = cd->ccfg & 0x000003DEU;
int i = 0;
int i;
/* Transfer direction */
plchan->runtime_direction = config->direction;
@ -1250,18 +1250,17 @@ static void dma_set_runtime_config(struct dma_chan *chan,
/*
* Now decide on a maxburst:
* If this channel will only request single transfers, set
* this down to ONE element.
* If this channel will only request single transfers, set this
* down to ONE element. Also select one element if no maxburst
* is specified.
*/
if (plchan->cd->single) {
if (plchan->cd->single || maxburst == 0) {
cctl |= (PL080_BSIZE_1 << PL080_CONTROL_SB_SIZE_SHIFT) |
(PL080_BSIZE_1 << PL080_CONTROL_DB_SIZE_SHIFT);
} else {
while (i < ARRAY_SIZE(burst_sizes)) {
for (i = 0; i < ARRAY_SIZE(burst_sizes); i++)
if (burst_sizes[i].burstwords <= maxburst)
break;
i++;
}
cctl |= burst_sizes[i].reg;
}