From 4440aacf3a171a0ab498feda58d100a320c5d9ff Mon Sep 17 00:00:00 2001 From: Russell King - ARM Linux Date: Mon, 3 Jan 2011 22:30:44 +0000 Subject: [PATCH] ARM: PL08x: fix array overflow in dma_set_runtime_config() If maxburst was passed in as zero, we would overflow the burst_sizes[] array. Fix this by checking for this condition, and defaulting to single transfer 'bursts'. Improve the readability of the loop using a for() loop rather than a while() loop with the iterator initialized far from the loop. Signed-off-by: Russell King Acked-by: Linus Walleij Signed-off-by: Dan Williams --- drivers/dma/amba-pl08x.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/drivers/dma/amba-pl08x.c b/drivers/dma/amba-pl08x.c index 3da49ed5f800..0809810f9e7a 100644 --- a/drivers/dma/amba-pl08x.c +++ b/drivers/dma/amba-pl08x.c @@ -1207,7 +1207,7 @@ static void dma_set_runtime_config(struct dma_chan *chan, u32 cctl = 0; /* Mask out all except src and dst channel */ u32 ccfg = cd->ccfg & 0x000003DEU; - int i = 0; + int i; /* Transfer direction */ plchan->runtime_direction = config->direction; @@ -1250,18 +1250,17 @@ static void dma_set_runtime_config(struct dma_chan *chan, /* * Now decide on a maxburst: - * If this channel will only request single transfers, set - * this down to ONE element. + * If this channel will only request single transfers, set this + * down to ONE element. Also select one element if no maxburst + * is specified. */ - if (plchan->cd->single) { + if (plchan->cd->single || maxburst == 0) { cctl |= (PL080_BSIZE_1 << PL080_CONTROL_SB_SIZE_SHIFT) | (PL080_BSIZE_1 << PL080_CONTROL_DB_SIZE_SHIFT); } else { - while (i < ARRAY_SIZE(burst_sizes)) { + for (i = 0; i < ARRAY_SIZE(burst_sizes); i++) if (burst_sizes[i].burstwords <= maxburst) break; - i++; - } cctl |= burst_sizes[i].reg; } -- 2.20.1