From 5be2190af4b03be5959684f7336c8da62606809e Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 23 Aug 2013 12:23:43 +0300 Subject: [PATCH] dmaengine: ste_dma40: off by one in d40_of_probe() If "num_disabled" is equal to STEDMA40_MAX_PHYS (32) then we would write one space beyond the end of the pdata->disable_channels[] array. Signed-off-by: Dan Carpenter Acked-by: Linus Walleij Signed-off-by: Vinod Koul --- drivers/dma/ste_dma40.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c index 7c268b96e760..7bbcabbc282a 100644 --- a/drivers/dma/ste_dma40.c +++ b/drivers/dma/ste_dma40.c @@ -3516,7 +3516,7 @@ static int __init d40_of_probe(struct platform_device *pdev, list = of_get_property(np, "disabled-channels", &num_disabled); num_disabled /= sizeof(*list); - if (num_disabled > STEDMA40_MAX_PHYS || num_disabled < 0) { + if (num_disabled >= STEDMA40_MAX_PHYS || num_disabled < 0) { d40_err(&pdev->dev, "Invalid number of disabled channels specified (%d)\n", num_disabled); -- 2.30.2