Commit 4440aacf authored by Russell King - ARM Linux's avatar Russell King - ARM Linux Committed by Dan Williams
Browse files

ARM: PL08x: fix array overflow in dma_set_runtime_config() 



If maxburst was passed in as zero, we would overflow the burst_sizes[]
array.  Fix this by checking for this condition, and defaulting to
single transfer 'bursts'.

Improve the readability of the loop using a for() loop rather than
a while() loop with the iterator initialized far from the loop.

Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
Acked-by: default avatarLinus Walleij <linus.walleij@stericsson.com>
Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
parent e8b5e11d

drivers/dma/amba-pl08x.c

+6 −7
Original line number Diff line number Diff line
@@ -1207,7 +1207,7 @@ static void dma_set_runtime_config(struct dma_chan *chan, 
	u32 cctl = 0;

	/* Mask out all except src and dst channel */

	u32 ccfg = cd->ccfg & 0x000003DEU;

	int i = 0;

	int i;



	/* Transfer direction */

	plchan->runtime_direction = config->direction;
@@ -1250,18 +1250,17 @@ static void dma_set_runtime_config(struct dma_chan *chan, 


	/*

	 * Now decide on a maxburst:

	 * If this channel will only request single transfers, set

	 * this down to ONE element.

	 * If this channel will only request single transfers, set this

	 * down to ONE element.  Also select one element if no maxburst

	 * is specified.

	 */

	if (plchan->cd->single) {

	if (plchan->cd->single || maxburst == 0) {

		cctl |= (PL080_BSIZE_1 << PL080_CONTROL_SB_SIZE_SHIFT) |

			(PL080_BSIZE_1 << PL080_CONTROL_DB_SIZE_SHIFT);

	} else {

		while (i < ARRAY_SIZE(burst_sizes)) {

		for (i = 0; i < ARRAY_SIZE(burst_sizes); i++)

			if (burst_sizes[i].burstwords <= maxburst)

				break;

			i++;

		}

		cctl |= burst_sizes[i].reg;

	}