dmaengine: ste_dma40: off by one in d40_of_probe()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 23 Aug 2013 09:23:43 +0000 (12:23 +0300)
committerVinod Koul <vinod.koul@intel.com>
Sun, 25 Aug 2013 10:53:32 +0000 (16:23 +0530)
If "num_disabled" is equal to STEDMA40_MAX_PHYS (32) then we would write
one space beyond the end of the pdata->disable_channels[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
drivers/dma/ste_dma40.c

index 7c268b96e7608502111086eb89e37c4acd07fa9f..7bbcabbc282ab23599c9d50355fc8d209b2731be 100644 (file)
@@ -3516,7 +3516,7 @@ static int __init d40_of_probe(struct platform_device *pdev,
        list = of_get_property(np, "disabled-channels", &num_disabled);
        num_disabled /= sizeof(*list);
 
-       if (num_disabled > STEDMA40_MAX_PHYS || num_disabled < 0) {
+       if (num_disabled >= STEDMA40_MAX_PHYS || num_disabled < 0) {
                d40_err(&pdev->dev,
                        "Invalid number of disabled channels specified (%d)\n",
                        num_disabled);