raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

dw-axi-dmac-platform: Avoid trampling with zero length buffer

Browse Source 
This code:
for_each_sg(sgl, sg, sg_len, i)
  num_sgs += DIV_ROUND_UP(sg_dma_len(sg), axi_block_len);

determines how many hw_desc are allocated.
If sg_dma_len(sg)=0 we don't allocate for this sgl.

However in the next loop, we will increment loop
for this case, and loop gets higher than num_sgs
and we trample memory.

Signed-off-by: Dom Cobley <popcornmix@gmail.com>
This commit is contained in:
popcornmix
2024-04-23 09:51:36 +01:00
committed by Dom Cobley
parent dc7510a448
commit 8f09fd6570
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
View File

@@ -963,6 +963,9 @@ dw_axi_dma_chan_prep_slave_sg(struct dma_chan *dchan, struct scatterlist *sgl,
mem = sg_dma_address(sg); mem = sg_dma_address(sg);
len = sg_dma_len(sg); len = sg_dma_len(sg);
num_segments = DIV_ROUND_UP(sg_dma_len(sg), axi_block_len); num_segments = DIV_ROUND_UP(sg_dma_len(sg), axi_block_len);
if (!num_segments)
continue;
segment_len = DIV_ROUND_UP(sg_dma_len(sg), num_segments); segment_len = DIV_ROUND_UP(sg_dma_len(sg), num_segments);
do { do {