]> git.baikalelectronics.ru Git - kernel.git/commit
dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type
authorRadhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Tue, 10 May 2022 07:12:40 +0000 (12:42 +0530)
committerVinod Koul <vkoul@kernel.org>
Mon, 16 May 2022 12:51:47 +0000 (18:21 +0530)
commit68d3601c8c72f316ed5026fd7064e7b272746fd0
tree060b6b7d3631b3a50b99fe77e41b2df5b50ebcc3
parentd76b6adda0e4d60d3c448666d0c9e945270c87b2
dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

In zynqmp_dma_alloc/free_chan_resources functions there is a
potential overflow in the below expressions.

dma_alloc_coherent(chan->dev, (2 * chan->desc_size *
   ZYNQMP_DMA_NUM_DESCS),
   &chan->desc_pool_p, GFP_KERNEL);

dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) *
                 ZYNQMP_DMA_NUM_DESCS),
                chan->desc_pool_v, chan->desc_pool_p);

The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though
this overflow condition is not observed but it is a potential problem
in the case of 32-bit multiplication. Hence fix it by changing the
desc_size data type to size_t.

In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in
dma_alloc_coherent API argument.

Addresses-Coverity: Event overflow_before_widen.
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Link: https://lore.kernel.org/r/1652166762-18317-2-git-send-email-radhey.shyam.pandey@xilinx.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
drivers/dma/xilinx/zynqmp_dma.c