From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , Vinod Koul Subject: [PATCH 4.1 21/84] dmaengine: pl330: Fix overflow when reporting residue in memcpy Date: Fri, 14 Aug 2015 10:41:49 -0700 Message-Id: <20150814174210.851605058@linuxfoundation.org> In-Reply-To: <20150814174210.214822912@linuxfoundation.org> References: <20150814174210.214822912@linuxfoundation.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: 4.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Krzysztof Kozlowski commit ae128293d97404f491dc76f1843c7adacfec3441 upstream. During memcpy operations the residue was always set to an u32 overflowed value. In pl330_tx_status() function number of currently transferred bytes was subtracted from internal "bytes_requested" field. However this "bytes_requested" was not initialized at start to length of memcpy buffer so transferred bytes were subtracted from 0 causing overflow. Signed-off-by: Krzysztof Kozlowski Fixes: aee4d1fac887 ("dmaengine: pl330: improve pl330_tx_status() function") Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman --- drivers/dma/pl330.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/dma/pl330.c +++ b/drivers/dma/pl330.c @@ -2621,6 +2621,7 @@ pl330_prep_dma_memcpy(struct dma_chan *c desc->rqcfg.brst_len = 1; desc->rqcfg.brst_len = get_burst_len(desc, len); + desc->bytes_requested = len; desc->txd.flags = flags;