dmaengine: ste_dma40: off by one in d40_of_probe()

PATCH Applied Dan Carpenter 3 participants 3 messages Aug 23, 2013 – Aug 25, 2013

Subsystems (3)

Kernel janitors dmaengine Arm/nomadik/Ux500 architectures

lore

Share & tools

lore

Dan Carpenter

author

2013-08-23 09:23 UTC #0 lore raw

PATCH 1/1 dmaengine: ste_dma40: off by one in d40_of_probe()

If "num_disabled" is equal to STEDMA40_MAX_PHYS (32) then we would write one space beyond the end of the pdata->disable_channels[] array.

Signed-off-by Dan Carpenter <[email protected]>

drivers/dma/ste_dma40.c +1 -1

index 0036756..e0157c8 100644
@@ -3516,7 +3516,7 @@ static int __init d40_of_probe(struct platform_device *pdev,
 	list = of_get_property(np, "disabled-channels", &num_disabled);
 	num_disabled /= sizeof(*list);
 
-	if (num_disabled > STEDMA40_MAX_PHYS || num_disabled < 0) {
+	if (num_disabled >= STEDMA40_MAX_PHYS || num_disabled < 0) {
 		d40_err(&pdev->dev,
 			"Invalid number of disabled channels specified (%d)\n",
 			num_disabled);

Linus Walleij

Acked-by on v1 1/1

2013-08-23 18:15 UTC #1 lore raw

Quoted 4 lines · Dan Carpenter

If "num_disabled" is equal to STEDMA40_MAX_PHYS (32) then we would write one space beyond the end of the pdata->disable_channels[] array.
Signed-off-by Dan Carpenter <[email protected]>

Acked-by Linus Walleij <[email protected]>

Yours,
Linus Walleij

Vinod Koul

Applied

2013-08-25 10:54 UTC #2 lore raw

In reply to Dan Carpenter

Quoted 2 lines · Dan Carpenter

If "num_disabled" is equal to STEDMA40_MAX_PHYS (32) then we would write one space beyond the end of the pdata->disable_channels[] array.

Applied, thanks

~Vinod