git.openwrt.org Git - openwrt/staging/stintel.git/blob

   1 From 5b3c219b5e5bc4ecd4e0dde7688929ff14cd08b0 Mon Sep 17 00:00:00 2001
   2 From: popcornmix <popcornmix@gmail.com>
   3 Date: Tue, 23 Apr 2024 09:51:36 +0100
   4 Subject: [PATCH 1047/1085] dw-axi-dmac-platform: Avoid trampling with zero
   5  length buffer
   6
   7 This code:
   8 for_each_sg(sgl, sg, sg_len, i)
   9   num_sgs += DIV_ROUND_UP(sg_dma_len(sg), axi_block_len);
  10
  11 determines how many hw_desc are allocated.
  12 If sg_dma_len(sg)=0 we don't allocate for this sgl.
  13
  14 However in the next loop, we will increment loop
  15 for this case, and loop gets higher than num_sgs
  16 and we trample memory.
  17
  18 Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  19 ---
  20  drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 3 +++
  21  1 file changed, 3 insertions(+)
  22
  23 --- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
  24 +++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
  25 @@ -916,6 +916,9 @@ dw_axi_dma_chan_prep_slave_sg(struct dma
  26                 mem = sg_dma_address(sg);
  27                 len = sg_dma_len(sg);
  28                 num_segments = DIV_ROUND_UP(sg_dma_len(sg), axi_block_len);
  29 +               if (!num_segments)
  30 +                       continue;
  31 +
  32                 segment_len = DIV_ROUND_UP(sg_dma_len(sg), num_segments);
  33
  34                 do {