[patch] dmaengine: ste_dma40: off by one in d40_of_probe()
From: Dan Carpenter <hidden>
Date: 2013-08-23 09:23:43
Also in:
kernel-janitors
Subsystem:
arm/nomadik/ux500 architectures, dma generic offload engine subsystem, the rest · Maintainers:
Linus Walleij, Vinod Koul, Linus Torvalds
If "num_disabled" is equal to STEDMA40_MAX_PHYS (32) then we would write one space beyond the end of the pdata->disable_channels[] array. Signed-off-by: Dan Carpenter <redacted>
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 0036756..e0157c8 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c@@ -3516,7 +3516,7 @@ static int __init d40_of_probe(struct platform_device *pdev, list = of_get_property(np, "disabled-channels", &num_disabled); num_disabled /= sizeof(*list); - if (num_disabled > STEDMA40_MAX_PHYS || num_disabled < 0) { + if (num_disabled >= STEDMA40_MAX_PHYS || num_disabled < 0) { d40_err(&pdev->dev, "Invalid number of disabled channels specified (%d)\n", num_disabled);