OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/drivers/dma
History
Pierre-Yves MORDRET 3e4543bf20 dmaengine: stm32-dmamux: fix a potential buffer overflow 
The bitfield dma_inuse is allocated of size dma_requests bits, thus a
valid bit address is from 0 to (dma_requests - 1).
When find_first_zero_bit() fails, it returns dma_requests as invalid
address.
Using such address for the following set_bit() is incorrect and, if
dma_requests is a multiple of BITS_PER_LONG, it will cause a buffer
overflow.
Currently this driver is only used in DT stm32h743.dtsi where a safe value
dma_requests=16 is not triggering the buffer overflow.

Fixed by checking the return value of find_first_zero_bit() _before_
using it.

Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com>
Signed-off-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
 		2018-03-22 10:51:35 +05:30
..
bestcomm License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
dw License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
hsu
…
ioat Merge branch 'for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu 2018-01-03 14:14:18 +01:00
ipu
…
ppc4xx
…
qcom Merge branch 'topic/qcom_hidma' into for-linus 2018-01-31 13:50:40 +05:30
sh dmaengine: rcar-dmac: fix max_chunk_size for R-Car Gen3 2018-02-27 20:34:38 +05:30
xilinx dmaengine: xilinx_dma: Free BD consistent memory 2018-01-08 16:24:50 +05:30
Kconfig Merge branch 'topic/sprd' into for-linus 2017-11-14 10:36:09 +05:30
Makefile dmaengine updates for 4.15-rc1 2017-11-14 16:49:31 -08:00
TODO
…
acpi-dma.c
…
altera-msgdma.c dmaengine: altera: Use IRQ-safe spinlock calls in the error paths as well 2017-10-20 11:51:10 +05:30
amba-pl08x.c dmaengine: amba-pl08x: Use vchan_terminate_vdesc() instead of desc_free 2017-12-04 22:33:51 +05:30
at_hdmac.c dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved 2017-11-29 19:48:17 +05:30
at_hdmac_regs.h dmaengine: at_hdmac: Remove unnecessary 0x prefixes before %pad 2017-11-08 10:47:04 +05:30
at_xdmac.c
…
bcm-sba-raid.c dmaengine: bcm-sba-raid: Use common GPL comment header 2017-10-23 11:35:47 +05:30
bcm2835-dma.c dmaengine: bcm2835-dma: Use vchan_terminate_vdesc() instead of desc_free 2017-12-04 22:33:51 +05:30
coh901318.c dmaengine: coh901318: Remove unnecessary 0x prefixes before %pad 2017-11-08 10:46:46 +05:30
coh901318.h
…
coh901318_lli.c
…
cppi41.c dmaengine: cppi41: Fix channel queues array size check 2017-12-22 17:47:04 +05:30
dma-axi-dmac.c dmaengine: axi-dmac: Fix software cyclic mode 2017-09-17 18:58:18 +05:30
dma-jz4740.c dmaengine: jz4740: disable/unprepare clk if probe fails 2017-12-11 09:00:06 +05:30
dma-jz4780.c dmaengine: dma-jz4780: Use vchan_terminate_vdesc() instead of desc_free 2017-12-04 22:33:51 +05:30
dmaengine.c
…
dmaengine.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
dmatest.c dmaengine: dmatest: fix container_of member in dmatest_callback 2018-01-30 12:24:43 +05:30
edma.c dmaengine: edma: Use vchan_terminate_vdesc() instead of desc_free 2017-12-04 22:33:51 +05:30
ep93xx_dma.c
…
fsl-edma.c dmaengine: fsl-edma: disable clks on all error paths 2017-12-15 09:53:04 +05:30
fsl_raid.c
…
fsl_raid.h
…
fsldma.c
…
fsldma.h
…
idma64.c
…
idma64.h
…
img-mdc-dma.c dmaengine: img-mdc-dma: Use vchan_terminate_vdesc() instead of desc_free 2017-12-04 22:33:51 +05:30
imx-dma.c ARM: 8745/1: get rid of __memzero() 2018-01-21 15:37:56 +00:00
imx-sdma.c dmaengine: imx-sdma: Add MODULE_FIRMWARE 2017-12-22 17:35:44 +05:30
iop-adma.c
…
k3dma.c dmaengine: k3dma: Use vchan_terminate_vdesc() instead of desc_free 2017-12-04 22:33:51 +05:30
lpc18xx-dmamux.c
…
mic_x100_dma.c dmaengine: mic_x100_dma: Use PTR_ERR_OR_ZERO() 2017-12-04 22:40:38 +05:30
mic_x100_dma.h
…
mmp_pdma.c
…
mmp_tdma.c
…
moxart-dma.c
…
mpc512x_dma.c
…
mv_xor.c
…
mv_xor.h
…
mv_xor_v2.c dmaengine: mv_xor_v2: Fix clock resource by adding a register clock 2018-03-11 20:33:27 +05:30
mxs-dma.c
…
nbpfaxi.c dmaengine: nbpfaxi: Use of_device_get_match_data() helper 2017-10-12 22:20:51 +05:30
of-dma.c
…
omap-dma.c dmaengine: omap-dma: Use vchan_terminate_vdesc() instead of desc_free 2017-12-04 22:33:51 +05:30
pch_dma.c dmaengine: pch_dma: Replace PCI pool old API 2017-10-31 17:01:06 +05:30
pl330.c dmaengine: pl330: fix descriptor allocation fail 2017-10-20 11:46:45 +05:30
pxa_dma.c
…
s3c24xx-dma.c dmaengine: s3c24xx-dma: Use vchan_terminate_vdesc() instead of desc_free 2017-12-04 22:33:51 +05:30
sa11x0-dma.c dmaengine: sa11x0: add DMA filters 2017-09-27 16:11:51 +05:30
sirf-dma.c
…
sprd-dma.c dmaengine: sprd: statify 'sprd_dma_prep_dma_memcpy' 2018-01-15 11:33:11 +05:30
st_fdma.c
…
st_fdma.h
…
ste_dma40.c
…
ste_dma40_ll.c
…
ste_dma40_ll.h
…
stm32-dma.c
…
stm32-dmamux.c dmaengine: stm32-dmamux: fix a potential buffer overflow 2018-03-22 10:51:35 +05:30
stm32-mdma.c dmaengine: stm32_mdma: activate pack/unpack feature 2017-11-08 10:49:53 +05:30
sun4i-dma.c
…
sun6i-dma.c dmaengine: sun6i: Retrieve channel count/max request from devicetree 2017-10-23 11:44:03 +05:30
tegra20-apb-dma.c dmaengine: tegra-apb: Support non-flow controlled slave configuration 2017-11-29 19:35:05 +05:30
tegra210-adma.c
…
ti-dma-crossbar.c dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63 2017-12-22 17:48:07 +05:30
timb_dma.c dmaengine: timb_dma: fix spelling mistake: "Couldnt" -> "Couldn't" 2017-12-11 08:57:38 +05:30
txx9dmac.c
…
txx9dmac.h
…
virt-dma.c dmaengine: virt-dma: Add helper to free/reuse a descriptor 2017-12-04 22:33:51 +05:30
virt-dma.h dmaengine: virt-dma: Support for race free transfer termination 2017-12-04 22:33:51 +05:30
xgene-dma.c
…
zx_dma.c
…