Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac860751 authored by Roel Kluin's avatar Roel Kluin Committed by Mike Frysinger
Browse files

Blackfin: fix read buffer overflow 



Check whether index is within bounds before testing the element.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarMike Frysinger <vapier@gentoo.org>
parent 0e101ec1

arch/blackfin/kernel/bfin_dma_5xx.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -147,8 +147,8 @@ EXPORT_SYMBOL(request_dma); 




int set_dma_callback(unsigned int channel, irq_handler_t callback, void *data)

int set_dma_callback(unsigned int channel, irq_handler_t callback, void *data)

{

{

	BUG_ON(!(dma_ch[channel].chan_status != DMA_CHANNEL_FREE

	BUG_ON(channel >= MAX_DMA_CHANNELS ||

	       && channel < MAX_DMA_CHANNELS));

			dma_ch[channel].chan_status == DMA_CHANNEL_FREE);





	if (callback != NULL) {

	if (callback != NULL) {

		int ret;

		int ret;
@@ -182,8 +182,8 @@ static void clear_dma_buffer(unsigned int channel) 
void free_dma(unsigned int channel)

void free_dma(unsigned int channel)

{

{

	pr_debug("freedma() : BEGIN \n");

	pr_debug("freedma() : BEGIN \n");

	BUG_ON(!(dma_ch[channel].chan_status != DMA_CHANNEL_FREE

	BUG_ON(channel >= MAX_DMA_CHANNELS ||

	       && channel < MAX_DMA_CHANNELS));

			dma_ch[channel].chan_status == DMA_CHANNEL_FREE);





	/* Halt the DMA */

	/* Halt the DMA */

	disable_dma(channel);

	disable_dma(channel);