From patchwork Mon Jun 15 08:25:16 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krzysztof Kozlowski X-Patchwork-Id: 6606661 Return-Path: X-Original-To: patchwork-dmaengine@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id E3F289F326 for ; Mon, 15 Jun 2015 08:26:00 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 2BBAD2052C for ; Mon, 15 Jun 2015 08:26:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 467D920528 for ; Mon, 15 Jun 2015 08:25:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754123AbbFOIZz (ORCPT ); Mon, 15 Jun 2015 04:25:55 -0400 Received: from mailout1.w1.samsung.com ([210.118.77.11]:63665 "EHLO mailout1.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751554AbbFOIZs (ORCPT ); Mon, 15 Jun 2015 04:25:48 -0400 Received: from eucpsbgm2.samsung.com (unknown [203.254.199.245]) by mailout1.w1.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTP id <0NPZ00DHB8QXHH30@mailout1.w1.samsung.com>; Mon, 15 Jun 2015 09:25:45 +0100 (BST) X-AuditID: cbfec7f5-f794b6d000001495-9b-557e8c09d8fc Received: from eusync3.samsung.com ( [203.254.199.213]) by eucpsbgm2.samsung.com (EUCPMTA) with SMTP id C6.31.05269.90C8E755; Mon, 15 Jun 2015 09:25:45 +0100 (BST) Received: from localhost.localdomain ([10.252.80.64]) by eusync3.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTPA id <0NPZ008488QA4UA0@eusync3.samsung.com>; Mon, 15 Jun 2015 09:25:45 +0100 (BST) From: Krzysztof Kozlowski To: Dan Williams , Vinod Koul , dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Marek Szyprowski , Krzysztof Kozlowski , stable@vger.kernel.org Subject: [PATCH] dmaengine: pl330: Fix overflow when reporting residue in memcpy Date: Mon, 15 Jun 2015 17:25:16 +0900 Message-id: <1434356716-32726-1-git-send-email-k.kozlowski@samsung.com> X-Mailer: git-send-email 1.9.1 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrPJMWRmVeSWpSXmKPExsVy+t/xq7qcPXWhBj+uy1pMn3qB0WL11L+s Fq9fGFpc3jWHzWLtkbvsFgs2PmK0eNm3n8WB3WPxnpdMHn1bVjF6fN4kF8AcxWWTkpqTWZZa pG+XwJXxdM5htoLn7BWLdn5gamA8ydbFyMEhIWAicfFYZRcjJ5ApJnHh3no2EFtIYCmjxMXJ AV2MXED2f0aJBT0nGEESbALGEpuXL2EDSYgIdDJKfJx8khUkwSxQIXG+fyUTiC0sECAxfeJq sAUsAqoSp27ygYR5BdwlJi1byg6xTE7i5LHJrBMYuRcwMqxiFE0tTS4oTkrPNdIrTswtLs1L 10vOz93ECAmGrzsYlx6zOsQowMGoxMMb8ak2VIg1say4MvcQowQHs5IIL39mXagQb0piZVVq UX58UWlOavEhRmkOFiVx3pm73ocICaQnlqRmp6YWpBbBZJk4OKUaGH0ebUhfv2puMXdkS+xq jfJWdfb9/qs5Trx8PPnJ8d1C7rL6i47fO7P/XOT2ec8ta1d+/z/9x4cHd1fPrat408PfkdZ3 8vCi1fXdk6x26iUZb5c99vRo6N2U/KbWo5Wv3xsGWORxGcRYTlzRVSc24+BFFuUPsUWX24pE /D2mXls9temzm1zXVm4lluKMREMt5qLiRABM+0MKAgIAAA== Sender: dmaengine-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: dmaengine@vger.kernel.org X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP During memcpy operations the residue was always set to an u32 overflowed value. In pl330_tx_status() function number of currently transferred bytes was subtracted from internal "bytes_requested" field. However this "bytes_requested" was not initialized at start to length of memcpy buffer so transferred bytes were subtracted from 0 causing overflow. Signed-off-by: Krzysztof Kozlowski Cc: Fixes: aee4d1fac887 ("dmaengine: pl330: improve pl330_tx_status() function") --- drivers/dma/pl330.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c index f513f77b1d85..c535cd059724 100644 --- a/drivers/dma/pl330.c +++ b/drivers/dma/pl330.c @@ -2623,6 +2623,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, desc->rqcfg.brst_len = 1; desc->rqcfg.brst_len = get_burst_len(desc, len); + desc->bytes_requested = len; desc->txd.flags = flags;