Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'dmaengine-fix-4.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/slave-dma
Pull dmaengine fix from Vinod Koul:
"One small fix for stm32-dmamux fixing buffer overflow"
* tag 'dmaengine-fix-4.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/slave-dma:
dmaengine: stm32-dmamux: fix a potential buffer overflow
+6
-3
+6
-3
drivers/dma/stm32-dmamux.c
+6
-3
drivers/dma/stm32-dmamux.c
···
118
118
spin_lock_irqsave(&dmamux->lock, flags);
119
119
mux->chan_id = find_first_zero_bit(dmamux->dma_inuse,
120
120
dmamux->dma_requests);
121
-
set_bit(mux->chan_id, dmamux->dma_inuse);
122
-
spin_unlock_irqrestore(&dmamux->lock, flags);
123
121
124
122
if (mux->chan_id == dmamux->dma_requests) {
123
+
spin_unlock_irqrestore(&dmamux->lock, flags);
125
124
dev_err(&pdev->dev, "Run out of free DMA requests\n");
126
125
ret = -ENOMEM;
127
-
goto error;
126
+
goto error_chan_id;
128
127
}
128
+
set_bit(mux->chan_id, dmamux->dma_inuse);
129
+
spin_unlock_irqrestore(&dmamux->lock, flags);
129
130
130
131
/* Look for DMA Master */
131
132
for (i = 1, min = 0, max = dmamux->dma_reqs[i];
···
174
173
175
174
error:
176
175
clear_bit(mux->chan_id, dmamux->dma_inuse);
176
+
177
+
error_chan_id:
177
178
kfree(mux);
178
179
return ERR_PTR(ret);
179
180
}