diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2012-09-21 12:15:37 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2012-09-21 12:15:37 -0700 |
| commit | 06b050eb81b877c7a4adb6be8624ad3890fee9f2 (patch) | |
| tree | b327d182c6167dcb275ff8d3e46e27df1dad9802 /drivers/dma/at_hdmac.c | |
| parent | 633650132e692efe273bf3a4e29411537a5baa86 (diff) | |
| parent | 61c6e7531d3b66b33187b8cdd700fd8ab93ffd62 (diff) | |
Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma
Pull slave-dmaengine fixes from Vinod Koul:
"There are two trivial fixes in pl330 driver and two in at_hdmac
driver."
* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
DMA: PL330: Check the pointer returned by kzalloc
DMA: PL330: Fix potential NULL pointer dereference in pl330_submit_req()
dmaengine: at_hdmac: check that each sg data length is non-null
dmaengine: at_hdmac: fix comment in atc_prep_slave_sg()
Diffstat (limited to 'drivers/dma/at_hdmac.c')
| -rw-r--r-- | drivers/dma/at_hdmac.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c index 3934fcc4e00b..7ab6e26664a7 100644 --- a/drivers/dma/at_hdmac.c +++ b/drivers/dma/at_hdmac.c @@ -661,7 +661,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, flags); if (unlikely(!atslave || !sg_len)) { - dev_dbg(chan2dev(chan), "prep_dma_memcpy: length is zero!\n"); + dev_dbg(chan2dev(chan), "prep_slave_sg: sg length is zero!\n"); return NULL; } @@ -689,6 +689,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, mem = sg_dma_address(sg); len = sg_dma_len(sg); + if (unlikely(!len)) { + dev_dbg(chan2dev(chan), + "prep_slave_sg: sg(%d) data length is zero\n", i); + goto err; + } mem_width = 2; if (unlikely(mem & 3 || len & 3)) mem_width = 0; @@ -724,6 +729,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, mem = sg_dma_address(sg); len = sg_dma_len(sg); + if (unlikely(!len)) { + dev_dbg(chan2dev(chan), + "prep_slave_sg: sg(%d) data length is zero\n", i); + goto err; + } mem_width = 2; if (unlikely(mem & 3 || len & 3)) mem_width = 0; @@ -757,6 +767,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, err_desc_get: dev_err(chan2dev(chan), "not enough descriptors available\n"); +err: atc_desc_put(atchan, first); return NULL; } |