diff options
| author | Russell King - ARM Linux <linux@arm.linux.org.uk> | 2011-01-04 01:30:44 +0300 |
|---|---|---|
| committer | Dan Williams <dan.j.williams@intel.com> | 2011-01-05 06:16:10 +0300 |
| commit | 4440aacf3a171a0ab498feda58d100a320c5d9ff (patch) | |
| tree | 582fa3a2b9a99d2f36394e29d02ac001d72d2ff6 /drivers/dma | |
| parent | e8b5e11df3d02e7bbd85c025cc705a8e67746f73 (diff) | |
| download | linux-4440aacf3a171a0ab498feda58d100a320c5d9ff.tar.xz | |
ARM: PL08x: fix array overflow in dma_set_runtime_config()
If maxburst was passed in as zero, we would overflow the burst_sizes[]
array. Fix this by checking for this condition, and defaulting to
single transfer 'bursts'.
Improve the readability of the loop using a for() loop rather than
a while() loop with the iterator initialized far from the loop.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Acked-by: Linus Walleij <linus.walleij@stericsson.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Diffstat (limited to 'drivers/dma')
| -rw-r--r-- | drivers/dma/amba-pl08x.c | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/drivers/dma/amba-pl08x.c b/drivers/dma/amba-pl08x.c index 3da49ed5f800..0809810f9e7a 100644 --- a/drivers/dma/amba-pl08x.c +++ b/drivers/dma/amba-pl08x.c @@ -1207,7 +1207,7 @@ static void dma_set_runtime_config(struct dma_chan *chan, u32 cctl = 0; /* Mask out all except src and dst channel */ u32 ccfg = cd->ccfg & 0x000003DEU; - int i = 0; + int i; /* Transfer direction */ plchan->runtime_direction = config->direction; @@ -1250,18 +1250,17 @@ static void dma_set_runtime_config(struct dma_chan *chan, /* * Now decide on a maxburst: - * If this channel will only request single transfers, set - * this down to ONE element. + * If this channel will only request single transfers, set this + * down to ONE element. Also select one element if no maxburst + * is specified. */ - if (plchan->cd->single) { + if (plchan->cd->single || maxburst == 0) { cctl |= (PL080_BSIZE_1 << PL080_CONTROL_SB_SIZE_SHIFT) | (PL080_BSIZE_1 << PL080_CONTROL_DB_SIZE_SHIFT); } else { - while (i < ARRAY_SIZE(burst_sizes)) { + for (i = 0; i < ARRAY_SIZE(burst_sizes); i++) if (burst_sizes[i].burstwords <= maxburst) break; - i++; - } cctl |= burst_sizes[i].reg; } |