From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932150AbcEQMA7 (ORCPT ); Tue, 17 May 2016 08:00:59 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:39855 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754774AbcEQMA5 (ORCPT ); Tue, 17 May 2016 08:00:57 -0400 From: Colin King To: Dan Williams , Vinod Koul , dmaengine@vger.kernel.org Cc: linux-kernel@vger.kernel.org Subject: [PATCH] dmaengine: do not allow access outside of unmap_pool Date: Tue, 17 May 2016 13:00:46 +0100 Message-Id: <1463486446-13890-1-git-send-email-colin.king@canonical.com> X-Mailer: git-send-email 2.8.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Colin Ian King When CONFIG_DMA_ENGINE_RAID is defined, unmap_pool[] is just 1 element in size, however, allows orders of 2..8 to access outside unmap_pool and returns an invalid address. Ensure we fall into the default path and report a BUG() when CONFIG_DMA_ENGINE_RAID is defined and order is out of range. Signed-off-by: Colin Ian King --- drivers/dma/dmaengine.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index 8c9f45f..6027e66 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -1100,12 +1100,14 @@ static struct dmaengine_unmap_pool *__get_unmap_pool(int nr) switch (order) { case 0 ... 1: return &unmap_pool[0]; + #if IS_ENABLED(CONFIG_DMA_ENGINE_RAID) case 2 ... 4: return &unmap_pool[1]; case 5 ... 7: return &unmap_pool[2]; case 8: return &unmap_pool[3]; + #endif default: BUG(); return NULL; -- 2.8.1