Commit 0c0eb4ca authored Jan 08, 2018 by Zi Yan Committed by Vinod Koul Feb 12, 2018

dmaengine: avoid map_cnt overflow with CONFIG_DMA_ENGINE_RAID



When CONFIG_DMA_ENGINE_RAID is enabled, unmap pool size can reach to
256. But in struct dmaengine_unmap_data, map_cnt is only u8, wrapping
to 0, if the unmap pool is maximally used. This triggers BUG() when
struct dmaengine_unmap_data is freed. Use u16 to fix the problem.

Signed-off-by: Zi Yan <zi.yan@cs.rutgers.edu>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>

parent 7928b2cb

include/linux/dmaengine.h

+4 −0

Original line number	Diff line number	Diff line
		@@ -470,7 +470,11 @@ typedef void (dma_async_tx_callback_result)(void dma_async_param,
		const struct dmaengine_result *result);

		struct dmaengine_unmap_data {
		#if IS_ENABLED(CONFIG_DMA_ENGINE_RAID)
		u16 map_cnt;
		#else
		u8 map_cnt;
		#endif
		u8 to_cnt;
		u8 from_cnt;
		u8 bidi_cnt;