From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from youngberry.canonical.com ([91.189.89.112]:48853 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753966AbbH0WM5 (ORCPT ); Thu, 27 Aug 2015 18:12:57 -0400 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Krzysztof Kozlowski , Vinod Koul , Kamal Mostafa Subject: [PATCH 3.19.y-ckt 070/130] dmaengine: pl330: Fix overflow when reporting residue in memcpy Date: Thu, 27 Aug 2015 15:11:01 -0700 Message-Id: <1440713521-5906-71-git-send-email-kamal@canonical.com> In-Reply-To: <1440713521-5906-1-git-send-email-kamal@canonical.com> References: <1440713521-5906-1-git-send-email-kamal@canonical.com> Sender: stable-owner@vger.kernel.org List-ID: 3.19.8-ckt6 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Krzysztof Kozlowski commit ae128293d97404f491dc76f1843c7adacfec3441 upstream. During memcpy operations the residue was always set to an u32 overflowed value. In pl330_tx_status() function number of currently transferred bytes was subtracted from internal "bytes_requested" field. However this "bytes_requested" was not initialized at start to length of memcpy buffer so transferred bytes were subtracted from 0 causing overflow. Signed-off-by: Krzysztof Kozlowski Fixes: aee4d1fac887 ("dmaengine: pl330: improve pl330_tx_status() function") Signed-off-by: Vinod Koul Signed-off-by: Kamal Mostafa --- drivers/dma/pl330.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c index bdf40b5..c068ef1 100644 --- a/drivers/dma/pl330.c +++ b/drivers/dma/pl330.c @@ -2521,6 +2521,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, desc->rqcfg.brst_len = 1; desc->rqcfg.brst_len = get_burst_len(desc, len); + desc->bytes_requested = len; desc->txd.flags = flags; -- 1.9.1