diff mbox

dmaengine: ste_dma40: off by one in d40_of_probe()

Message ID 20130823092343.GF31293@elgon.mountain (mailing list archive)
State New, archived
Headers show

Commit Message

Dan Carpenter Aug. 23, 2013, 9:23 a.m. UTC 
If "num_disabled" is equal to STEDMA40_MAX_PHYS (32) then we would write
one space beyond the end of the pdata->disable_channels[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Linus Walleij Aug. 23, 2013, 6:15 p.m. UTC | #1 
On Fri, Aug 23, 2013 at 11:23 AM, Dan Carpenter
<dan.carpenter@oracle.com> wrote:

> If "num_disabled" is equal to STEDMA40_MAX_PHYS (32) then we would write
> one space beyond the end of the pdata->disable_channels[] array.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Acked-by: Linus Walleij <linus.walleij@linaro.org>

Yours,
Linus Walleij
Vinod Koul Aug. 25, 2013, 10:54 a.m. UTC | #2 
On Fri, Aug 23, 2013 at 12:23:43PM +0300, Dan Carpenter wrote:
> If "num_disabled" is equal to STEDMA40_MAX_PHYS (32) then we would write
> one space beyond the end of the pdata->disable_channels[] array.
Applied, thanks

~Vinod
diff mbox

Patch

diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 0036756..e0157c8 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -3516,7 +3516,7 @@  static int __init d40_of_probe(struct platform_device *pdev,
 	list = of_get_property(np, "disabled-channels", &num_disabled);
 	num_disabled /= sizeof(*list);
 
-	if (num_disabled > STEDMA40_MAX_PHYS || num_disabled < 0) {
+	if (num_disabled >= STEDMA40_MAX_PHYS || num_disabled < 0) {
 		d40_err(&pdev->dev,
 			"Invalid number of disabled channels specified (%d)\n",
 			num_disabled);