lkml.org 
[lkml]   [2015]   [Aug]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.19.y-ckt 070/130] dmaengine: pl330: Fix overflow when reporting residue in memcpy
    Date
    3.19.8-ckt6 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Krzysztof Kozlowski <k.kozlowski@samsung.com>

    commit ae128293d97404f491dc76f1843c7adacfec3441 upstream.

    During memcpy operations the residue was always set to an u32 overflowed
    value.

    In pl330_tx_status() function number of currently transferred bytes was
    subtracted from internal "bytes_requested" field. However this
    "bytes_requested" was not initialized at start to length of memcpy
    buffer so transferred bytes were subtracted from 0 causing overflow.

    Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
    Fixes: aee4d1fac887 ("dmaengine: pl330: improve pl330_tx_status() function")
    Signed-off-by: Vinod Koul <vinod.koul@intel.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/dma/pl330.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
    index bdf40b5..c068ef1 100644
    --- a/drivers/dma/pl330.c
    +++ b/drivers/dma/pl330.c
    @@ -2521,6 +2521,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
    desc->rqcfg.brst_len = 1;

    desc->rqcfg.brst_len = get_burst_len(desc, len);
    + desc->bytes_requested = len;

    desc->txd.flags = flags;

    --
    1.9.1


    \
     
     \ /
      Last update: 2015-08-28 01:01    [W:4.808 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site