Blackfin: fix read buffer overflow
Check whether index is within bounds before testing the element.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
diff --git a/arch/blackfin/kernel/bfin_dma_5xx.c b/arch/blackfin/kernel/bfin_dma_5xx.c
index 14dea1a..384868d 100644
--- a/arch/blackfin/kernel/bfin_dma_5xx.c
+++ b/arch/blackfin/kernel/bfin_dma_5xx.c
@@ -147,8 +147,8 @@
int set_dma_callback(unsigned int channel, irq_handler_t callback, void *data)
{
- BUG_ON(!(dma_ch[channel].chan_status != DMA_CHANNEL_FREE
- && channel < MAX_DMA_CHANNELS));
+ BUG_ON(channel >= MAX_DMA_CHANNELS ||
+ dma_ch[channel].chan_status == DMA_CHANNEL_FREE);
if (callback != NULL) {
int ret;
@@ -182,8 +182,8 @@
void free_dma(unsigned int channel)
{
pr_debug("freedma() : BEGIN \n");
- BUG_ON(!(dma_ch[channel].chan_status != DMA_CHANNEL_FREE
- && channel < MAX_DMA_CHANNELS));
+ BUG_ON(channel >= MAX_DMA_CHANNELS ||
+ dma_ch[channel].chan_status == DMA_CHANNEL_FREE);
/* Halt the DMA */
disable_dma(channel);