Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5be2190a authored by Dan Carpenter's avatar Dan Carpenter Committed by Vinod Koul
Browse files

dmaengine: ste_dma40: off by one in d40_of_probe() 



If "num_disabled" is equal to STEDMA40_MAX_PHYS (32) then we would write
one space beyond the end of the pdata->disable_channels[] array.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
parent 3a919d5b

drivers/dma/ste_dma40.c

+1 −1
Original line number Diff line number Diff line
@@ -3516,7 +3516,7 @@ static int __init d40_of_probe(struct platform_device *pdev, 
	list = of_get_property(np, "disabled-channels", &num_disabled);

	num_disabled /= sizeof(*list);



	if (num_disabled > STEDMA40_MAX_PHYS || num_disabled < 0) {

	if (num_disabled >= STEDMA40_MAX_PHYS || num_disabled < 0) {

		d40_err(&pdev->dev,

			"Invalid number of disabled channels specified (%d)\n",

			num_disabled);