Blackfin: fix read buffer overflow
authorRoel Kluin <roel.kluin@gmail.com>
Sun, 2 Aug 2009 12:26:48 +0000 (14:26 +0200)
committerMike Frysinger <vapier@gentoo.org>
Thu, 17 Sep 2009 02:10:13 +0000 (22:10 -0400)
Check whether index is within bounds before testing the element.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
arch/blackfin/kernel/bfin_dma_5xx.c

index 14dea1a87b7c0be2c950d2f6da1d0f9209738d7d..384868dedac3771c2de63a42829129706e88f39b 100644 (file)
@@ -147,8 +147,8 @@ EXPORT_SYMBOL(request_dma);
 
 int set_dma_callback(unsigned int channel, irq_handler_t callback, void *data)
 {
-       BUG_ON(!(dma_ch[channel].chan_status != DMA_CHANNEL_FREE
-              && channel < MAX_DMA_CHANNELS));
+       BUG_ON(channel >= MAX_DMA_CHANNELS ||
+                       dma_ch[channel].chan_status == DMA_CHANNEL_FREE);
 
        if (callback != NULL) {
                int ret;
@@ -182,8 +182,8 @@ static void clear_dma_buffer(unsigned int channel)
 void free_dma(unsigned int channel)
 {
        pr_debug("freedma() : BEGIN \n");
-       BUG_ON(!(dma_ch[channel].chan_status != DMA_CHANNEL_FREE
-              && channel < MAX_DMA_CHANNELS));
+       BUG_ON(channel >= MAX_DMA_CHANNELS ||
+                       dma_ch[channel].chan_status == DMA_CHANNEL_FREE);
 
        /* Halt the DMA */
        disable_dma(channel);