From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1422956Ab2I1UsA (ORCPT ); Fri, 28 Sep 2012 16:48:00 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:54936 "EHLO out1-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1031541Ab2I1Uru (ORCPT ); Fri, 28 Sep 2012 16:47:50 -0400 X-Sasl-enc: T4e3EA13DGB6L/jnO0ohBuIG8aIkNUBRMczZCDXtMVDs 1348865269 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , alan@lxorguk.ukuu.org.uk, Nicolas Ferre , Vinod Koul Subject: [ 067/127] dmaengine: at_hdmac: check that each sg data length is non-null Date: Fri, 28 Sep 2012 13:34:00 -0700 Message-Id: <20120928203053.746085704@linuxfoundation.org> X-Mailer: git-send-email 1.7.12.1.428.g652398a In-Reply-To: <20120928203045.835238916@linuxfoundation.org> References: <20120928203045.835238916@linuxfoundation.org> User-Agent: quilt/0.60-2.1.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.0-stable review patch. If anyone has any objections, please let me know. ------------------ From: Nicolas Ferre commit c456797681db814f4f5b36909e8e94047bf53d9c upstream. Avoid the construction of a malformed DMA request sent to the DMA controller. Log message is for debug only because this condition is unlikely to append and may only trigger at driver development time. Signed-off-by: Nicolas Ferre Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman --- drivers/dma/at_hdmac.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/drivers/dma/at_hdmac.c +++ b/drivers/dma/at_hdmac.c @@ -702,6 +702,11 @@ atc_prep_slave_sg(struct dma_chan *chan, mem = sg_dma_address(sg); len = sg_dma_len(sg); + if (unlikely(!len)) { + dev_dbg(chan2dev(chan), + "prep_slave_sg: sg(%d) data length is zero\n", i); + goto err; + } mem_width = 2; if (unlikely(mem & 3 || len & 3)) mem_width = 0; @@ -736,6 +741,11 @@ atc_prep_slave_sg(struct dma_chan *chan, mem = sg_dma_address(sg); len = sg_dma_len(sg); + if (unlikely(!len)) { + dev_dbg(chan2dev(chan), + "prep_slave_sg: sg(%d) data length is zero\n", i); + goto err; + } mem_width = 2; if (unlikely(mem & 3 || len & 3)) mem_width = 0; @@ -769,6 +779,7 @@ atc_prep_slave_sg(struct dma_chan *chan, err_desc_get: dev_err(chan2dev(chan), "not enough descriptors available\n"); +err: atc_desc_put(atchan, first); return NULL; }