Re: [PATCH v1 1/1] dmaengine: stm32-dmamux: fix a potential buffer overflow

2018-03-21 Thread Vinod Koul
On Tue, Mar 13, 2018 at 05:55:35PM +0100, Pierre-Yves MORDRET wrote: > The bitfield dma_inuse is allocated of size dma_requests bits, thus a > valid bit address is from 0 to (dma_requests - 1). > When find_first_zero_bit() fails, it returns dma_requests as invalid > address. > Using such address fo

[PATCH v1 1/1] dmaengine: stm32-dmamux: fix a potential buffer overflow

2018-03-13 Thread Pierre-Yves MORDRET
The bitfield dma_inuse is allocated of size dma_requests bits, thus a valid bit address is from 0 to (dma_requests - 1). When find_first_zero_bit() fails, it returns dma_requests as invalid address. Using such address for the following set_bit() is incorrect and, if dma_requests is a multiple of BI