summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRoel Kluin <roel.kluin@gmail.com>2009-08-02 14:26:48 +0200
committerMike Frysinger <vapier@gentoo.org>2009-09-16 22:10:13 -0400
commitac860751eb2cb1bdf8bb341d849b38c483f5d83b (patch)
tree15822847c84aa55a4344a3c92ed334974ee65472
parent0e101ec12e68f25dd769a4b7ecb5e7ead0aae7c0 (diff)
Blackfin: fix read buffer overflow
Check whether index is within bounds before testing the element. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
-rw-r--r--arch/blackfin/kernel/bfin_dma_5xx.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/arch/blackfin/kernel/bfin_dma_5xx.c b/arch/blackfin/kernel/bfin_dma_5xx.c
index 14dea1a87b7c..384868dedac3 100644
--- a/arch/blackfin/kernel/bfin_dma_5xx.c
+++ b/arch/blackfin/kernel/bfin_dma_5xx.c
@@ -147,8 +147,8 @@ EXPORT_SYMBOL(request_dma);
int set_dma_callback(unsigned int channel, irq_handler_t callback, void *data)
{
- BUG_ON(!(dma_ch[channel].chan_status != DMA_CHANNEL_FREE
- && channel < MAX_DMA_CHANNELS));
+ BUG_ON(channel >= MAX_DMA_CHANNELS ||
+ dma_ch[channel].chan_status == DMA_CHANNEL_FREE);
if (callback != NULL) {
int ret;
@@ -182,8 +182,8 @@ static void clear_dma_buffer(unsigned int channel)
void free_dma(unsigned int channel)
{
pr_debug("freedma() : BEGIN \n");
- BUG_ON(!(dma_ch[channel].chan_status != DMA_CHANNEL_FREE
- && channel < MAX_DMA_CHANNELS));
+ BUG_ON(channel >= MAX_DMA_CHANNELS ||
+ dma_ch[channel].chan_status == DMA_CHANNEL_FREE);
/* Halt the DMA */
disable_dma(channel);