[PATCH 2/2] dma: dmatest: Add check for supported buffer count (sg_buffers)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



When using dmatest with sg_buffers=128 I stumbled upon the problem, that
the "map_cnt" variable of "struct dmaengine_unmap_data" was set to 0.
"map_cnt" is an "u8" variable, resulting in an overrun when its
value is set to src_cnt + dst_cnt, to twice the sg_buffer value.

This patch adds a small check to dmatest, so that this confusing error
is detected and the test is aborted.

Signed-off-by: Stefan Roese <sr@xxxxxxx>
Cc: Kedareswara rao Appana <appanad@xxxxxxxxxx>
Cc: Vinod Koul <vinod.koul@xxxxxxxxx>
---
 drivers/dma/dmatest.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 54d581d407aa..6539f919c57a 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -535,6 +535,13 @@ static int dmatest_func(void *data)
 
 		total_tests++;
 
+		/* Check if buffer count fits into map count variable (u8) */
+		if ((src_cnt + dst_cnt) >= 255) {
+			pr_err("too many buffers (%d of 255 supported)\n",
+			       src_cnt + dst_cnt);
+			break;
+		}
+
 		if (1 << align > params->buf_size) {
 			pr_err("%u-byte buffer too small for %d-byte alignment\n",
 			       params->buf_size, 1 << align);
-- 
2.12.2

--
To unsubscribe from this list: send the line "unsubscribe dmaengine" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Kernel]     [Linux ARM (vger)]     [Linux ARM MSM]     [Linux Omap]     [Linux Arm]     [Linux Tegra]     [Fedora ARM]     [Linux for Samsung SOC]     [eCos]     [Linux PCI]     [Linux Fastboot]     [Gcc Help]     [Git]     [DCCP]     [IETF Announce]     [Security]     [Linux MIPS]     [Yosemite Campsites]

  Powered by Linux