[bug report] dmaengine: add Qualcomm Technologies HIDMA management driver

[bug report] dmaengine: add Qualcomm Technologies HIDMA management driver

[Dan Carpenter]

Hello Sinan Kaya,

The patch 7f8f209fd6e0: "dmaengine: add Qualcomm Technologies HIDMA
management driver" from Feb 4, 2016, leads to the following Smatch
static checker warning:

	drivers/dma/qcom/hidma_mgmt.c:101 hidma_mgmt_setup()
	warn: uncapped user loop index 'i'

drivers/dma/qcom/hidma_mgmt.c
    91         }
    92 
    93         if (mgmtdev->max_rd_xactions > HIDMA_MAX_RD_XACTIONS_MASK) {
    94                 dev_err(&mgmtdev->pdev->dev,
    95                         "max_rd_xactions cannot be bigger than %ld\n",
    96                         HIDMA_MAX_RD_XACTIONS_MASK);
    97                 return -EINVAL;
    98         }
    99 
    100         for (i = 0; i < mgmtdev->dma_channels; i++) {
--> 101                 if (mgmtdev->priority[i] > 1) {
                            ^^^^^^^^^^^^^^^^^^^^
The sysfs interface lets you set mgmtdev->dma_channels so this is an
array out of bounds access.  It's in hidma_mgmt_sys.c

drivers/dma/qcom/hidma_mgmt_sys.c
    26  #define IMPLEMENT_GETSET(name)                                  \
    27  static int get_##name(struct hidma_mgmt_dev *mdev)              \
    28  {                                                               \
    29          return mdev->name;                                      \
    30  }                                                               \
    31  static int set_##name(struct hidma_mgmt_dev *mdev, u64 val)     \
    32  {                                                               \
    33          u64 tmp;                                                \
    34          int rc;                                                 \
    35                                                                  \
    36          tmp = mdev->name;                                       \
    37          mdev->name = val;                                       \
    38          rc = hidma_mgmt_setup(mdev);                            \
    39          if (rc)                                                 \
    40                  mdev->name = tmp;                               \
    41          return rc;                                              \
    42  }
    43  
    44  #define DECLARE_ATTRIBUTE(name, mode)                           \
    45          {#name, mode, get_##name, set_##name}
    46  
    47  IMPLEMENT_GETSET(hw_version_major)
    48  IMPLEMENT_GETSET(hw_version_minor)
    49  IMPLEMENT_GETSET(max_wr_xactions)
    50  IMPLEMENT_GETSET(max_rd_xactions)
    51  IMPLEMENT_GETSET(max_write_request)
    52  IMPLEMENT_GETSET(max_read_request)
    53  IMPLEMENT_GETSET(dma_channels)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    54  IMPLEMENT_GETSET(chreset_timeout_cycles)

regards,
dan carpenter