Merge tag 'v4.3-rc2' into k.o/for-4.3-v1

[firefly-linux-kernel-4.4.55.git] / drivers / dma / ioat / prep.c

diff --git a/drivers/dma/ioat/prep.c b/drivers/dma/ioat/prep.c
index e323a4036908454a01329d805f354c06c153ab1f..ad4fb41cd23bedae1c42118f80cf710501818eb8 100644 (file)
--- a/drivers/dma/ioat/prep.c
+++ b/drivers/dma/ioat/prep.c
@@ -26,6 +26,8 @@
 #include "hw.h"
 #include "dma.h"
 
+#define MAX_SCF        1024
+
 /* provide a lookup table for setting the source address in the base or
  * extended descriptor of an xor or pq descriptor
  */
@@ -634,9 +636,12 @@ struct dma_async_tx_descriptor *
 ioat_prep_pqxor(struct dma_chan *chan, dma_addr_t dst, dma_addr_t *src,
                 unsigned int src_cnt, size_t len, unsigned long flags)
 {
-       unsigned char scf[src_cnt];
+       unsigned char scf[MAX_SCF];
        dma_addr_t pq[2];
 
+       if (src_cnt > MAX_SCF)
+               return NULL;
+
        memset(scf, 0, src_cnt);
        pq[0] = dst;
        flags |= DMA_PREP_PQ_DISABLE_Q;
@@ -654,9 +659,12 @@ ioat_prep_pqxor_val(struct dma_chan *chan, dma_addr_t *src,
                     unsigned int src_cnt, size_t len,
                     enum sum_check_flags *result, unsigned long flags)
 {
-       unsigned char scf[src_cnt];
+       unsigned char scf[MAX_SCF];
        dma_addr_t pq[2];
 
+       if (src_cnt > MAX_SCF)
+               return NULL;
+
        /* the cleanup routine only sets bits on validate failure, it
         * does not clear bits on validate success... so clear it here
         */