Skip to content

Commit 38a4641

Browse files
committed
dw-axi-dmac-platform: Avoid trampling with zero length buffer
This code: for_each_sg(sgl, sg, sg_len, i) num_sgs += DIV_ROUND_UP(sg_dma_len(sg), axi_block_len); determines how many hw_desc are allocated. If sg_dma_len(sg)=0 we don't allocate for this sgl. However in the next loop, we will increment loop for this case, and loop gets higher than num_sgs and we trample memory. Signed-off-by: Dom Cobley <popcornmix@gmail.com>
1 parent 9c68ba1 commit 38a4641

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -916,6 +916,9 @@ dw_axi_dma_chan_prep_slave_sg(struct dma_chan *dchan, struct scatterlist *sgl,
916916
mem = sg_dma_address(sg);
917917
len = sg_dma_len(sg);
918918
num_segments = DIV_ROUND_UP(sg_dma_len(sg), axi_block_len);
919+
if (num_segments == 0)
920+
continue;
921+
919922
segment_len = DIV_ROUND_UP(sg_dma_len(sg), num_segments);
920923

921924
do {

0 commit comments

Comments
 (0)