Skip to content

Commit 2fb0e57

Browse files
committed
dw-axi-dmac-platform: Avoid trampling with zero length buffer
This code: for_each_sg(sgl, sg, sg_len, i) num_sgs += DIV_ROUND_UP(sg_dma_len(sg), axi_block_len); determines how many hw_desc are allocated. If sg_dma_len(sg)=0 we don't allocate for this sgl. However in the next loop, we will increment loop for this case, and loop gets higher than num_sgs and we trample memory. Signed-off-by: Dom Cobley <[email protected]>
1 parent 84010d5 commit 2fb0e57

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -963,6 +963,9 @@ dw_axi_dma_chan_prep_slave_sg(struct dma_chan *dchan, struct scatterlist *sgl,
963963
mem = sg_dma_address(sg);
964964
len = sg_dma_len(sg);
965965
num_segments = DIV_ROUND_UP(sg_dma_len(sg), axi_block_len);
966+
if (!num_segments)
967+
continue;
968+
966969
segment_len = DIV_ROUND_UP(sg_dma_len(sg), num_segments);
967970

968971
do {

0 commit comments

Comments
 (0)