Hi Guennadi,

On Thu, Jan 26, 2012 at 03:56:18PM +0100, Guennadi Liakhovetski wrote:

This patch adds a library of functions, helping to implement dmaengine
drivers for hardware, unable to handle scatter-gather lists natively.
The first version of this driver only supports memcpy and slave DMA
operation.

Signed-off-by: Guennadi Liakhovetski <redacted>
---

[...]

+
+/*
+ * For slave DMA we assume, that there is a finite number of DMA slaves in the
+ * system, and that each such slave can only use a finite number of channels.
+ * We use slave channel IDs to make sure, that no such slave channel ID is
+ * allocated more than once.
+ */
+static unsigned int slave_num = 256;
+module_param(slave_num, uint, 0444);
+
+/* A bitmask with slave_num bits */
+static unsigned long *simple_slave_used;

You never check that the slave ids passed into this code are
within the range of slave_num. Given that this is a user changeable
value this is a bit flawy.

Sascha

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |