From fbfb8e1dcea0508f203535a92faea7a3ddf24558 Mon Sep 17 00:00:00 2001 From: Stefan Roese Date: Thu, 27 Apr 2017 14:21:41 +0200 Subject: dmaengine: dmatest: Add check for supported buffer count (sg_buffers) When using dmatest with sg_buffers=128 I stumbled upon the problem, that the "map_cnt" variable of "struct dmaengine_unmap_data" was set to 0. "map_cnt" is an "u8" variable, resulting in an overrun when its value is set to src_cnt + dst_cnt, to twice the sg_buffer value. This patch adds a small check to dmatest, so that this confusing error is detected and the test is aborted. Signed-off-by: Stefan Roese Cc: Kedareswara rao Appana Cc: Vinod Koul Signed-off-by: Vinod Koul --- drivers/dma/dmatest.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c index d042b2b4965e..a07ef3d6b3ec 100644 --- a/drivers/dma/dmatest.c +++ b/drivers/dma/dmatest.c @@ -535,6 +535,13 @@ static int dmatest_func(void *data) total_tests++; + /* Check if buffer count fits into map count variable (u8) */ + if ((src_cnt + dst_cnt) >= 255) { + pr_err("too many buffers (%d of 255 supported)\n", + src_cnt + dst_cnt); + break; + } + if (1 << align > params->buf_size) { pr_err("%u-byte buffer too small for %d-byte alignment\n", params->buf_size, 1 << align); -- cgit v1.2.3