brain-hackers_pepepper-mirror
/
u-boot-brain
mirror of https://github.com/brain-hackers/u-boot-brain
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

dma: bcm6348: incorrect buffer allocation 

Calling calloc() for 0 members does not make any sense.
Setting ch_priv->busy_desc = NULL for ch_priv->desc_cnt > 0 is equally
unreasonable.

The current code will lead to a NULL dereference in bcm6348_iudma_enable().

The assignments for ch_priv->busy_desc are obviously swapped.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
This commit is contained in:
Heinrich Schuchardt 2020-12-27 10:26:00 +01:00 committed by Tom Rini
parent 9e9a530a61
commit 4908067b8f
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/dma/bcm6348-iudma.c
View File

@ -313,10 +313,10 @@ static int bcm6348_iudma_request(struct dma *dma)
ch_priv->desc_id = 0;
if (bcm6348_iudma_chan_is_rx(dma->id)) {
ch_priv->desc_cnt = 0;
ch_priv->busy_desc = calloc(ch_priv->desc_cnt, sizeof(bool));
ch_priv->busy_desc = NULL;
} else {
ch_priv->desc_cnt = ch_priv->dma_ring_size;
ch_priv->busy_desc = NULL;
ch_priv->busy_desc = calloc(ch_priv->desc_cnt, sizeof(bool));
}
return 0;