From patchwork Fri Jul 28 13:15:49 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 9868763 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9E22960382 for ; Fri, 28 Jul 2017 13:16:54 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 820DF288E0 for ; Fri, 28 Jul 2017 13:16:54 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7F0CD288E2; Fri, 28 Jul 2017 13:16:54 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.4 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 19885288E0 for ; Fri, 28 Jul 2017 13:16:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752028AbdG1NQd (ORCPT ); Fri, 28 Jul 2017 09:16:33 -0400 Received: from mout.kundenserver.de ([212.227.126.187]:65233 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751764AbdG1NQa (ORCPT ); Fri, 28 Jul 2017 09:16:30 -0400 Received: from wuerfel.lan ([78.43.238.10]) by mrelayeu.kundenserver.de (mreue001 [212.227.15.129]) with ESMTPA (Nemesis) id 0M6ahg-1dpZi844zU-00wSnV; Fri, 28 Jul 2017 15:16:17 +0200 From: Arnd Bergmann To: Vinod Koul Cc: Arnd Bergmann , Dan Williams , =?UTF-8?q?Niklas=20S=C3=B6derlund?= , Laurent Pinchart , Geert Uytterhoeven , Kuninori Morimoto , dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] dmaengine: rcar-dmac: avoid array overflow Date: Fri, 28 Jul 2017 15:15:49 +0200 Message-Id: <20170728131613.122505-1-arnd@arndb.de> X-Mailer: git-send-email 2.9.0 X-Provags-ID: V03:K0:j8txVfLlsMMYvuFTzNGC1Hzy+bdro0OvnCjFdAL5jMbl8zO9hgJ NhGhDpGBOxBhOQAW4Po+A9/eAN09Gjm6YTZ6RnZxkjcFf1mWYMLNaeInRyYt8Kz3h+BMNw7 L4CFdhVQcS1cwZ5pvZTEu5XT+UVYDG/7TRMQYSLIcC+9zhrZRjuVTnwx/X1ycUZpUPLBVUU uQNYnjNY6m11Luz97Po8w== X-UI-Out-Filterresults: notjunk:1; V01:K0:T/qyQ8YG6+M=:kqeIB0E3C+jkJD2zmpxO1C UI2I84psFupGkpsGYBq9TuOKKhScd9AkPHVo+Mf/9dM2/PpUZh1I9ECP2MHbegZOqrTnhOwRw dm1j9Z3dq3BTqAQr6++BIsYbGiQWWmlmhxoqBX9puHAacJR7sGKuk+N320Nah7mXPoxz6sSGG iCmXvBMu/6+/xbkZgRpmWAbrx3yxbL4leP69dOU1bk6XR2SVIRa2pjP0NQBL2fzPfCTwyEgf9 ZY0DrGl2Hqhu6oFKXgGgpDIhOBLdYjI0FHkI/QGE/H2fN5E/Y63uhN/K7mdBDkGeNe5jkqOcn HnMkXO3GdQiU4Xja32XoKsS6emoDaYVLBIxipeCQD6nH47cXwO4IdCw1erQn31zfVugnDYy6C n42sk+Au5Aygr3rh27IGR9Vgvst0uo7TZavN/C/USIQogiUC+Sk2moN1PPcF/dD3L7Mt6MOuu b82tbEDhZMCryyiO0Y4XczcoiHuGz67lLlKpV6tahI65Dxhx0483CmdpidNs5COiJm7oUbNSA b8aeysQl8aBY53E3+Ee4lUXm1L2l29xTiVmRkbndzx/o5juOsrh+Loivp3Zl0Sr/WmwIFbCFO oazWrXy9JNWCLJ8fTYTa07bteVHKxA7BLqzxsaw3O1C/KxQSrdrh17X9cmZ0TB6SvsFJ/EZAX 3VIk3G280VBa8aM8nIvcx/CNkmWmlUwSijvXAab6scbQYRLf6Slig3Mi7PUyQSmpN37EXei00 31FrN9b0Ug8SJO99f983frYOlpwqS11tfKgESw== Sender: dmaengine-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: dmaengine@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Building with CONFIG_UBSAN_SANITIZE_ALL shows this warning: drivers/dma/sh/rcar-dmac.c: In function 'rcar_dmac_chan_prep_sg': drivers/dma/sh/rcar-dmac.c:839:29: error: array subscript is above array bounds [-Werror=array-bounds] desc->chcr = chcr | chcr_ts[desc->xfer_shift]; As the compiler doesn't know what the xfer_size is, it is impossible to rule out the array overflow here. As we know that xfer_size can only be within enum dma_slave_buswidth, this will not overflow for correct users, and adding a range check will handle the obscure case and shut up the warning. Fixes: 87244fe5abdf ("dmaengine: rcar-dmac: Add Renesas R-Car Gen2 DMA Controller (DMAC) driver") Signed-off-by: Arnd Bergmann Reviewed-by: Niklas Söderlund --- drivers/dma/sh/rcar-dmac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c index ffcadca53243..f5b28eb4009e 100644 --- a/drivers/dma/sh/rcar-dmac.c +++ b/drivers/dma/sh/rcar-dmac.c @@ -836,7 +836,8 @@ static void rcar_dmac_chan_configure_desc(struct rcar_dmac_chan *chan, } desc->xfer_shift = ilog2(xfer_size); - desc->chcr = chcr | chcr_ts[desc->xfer_shift]; + if (desc->xfer_shift < ARRAY_SIZE(chcr_ts)) + desc->chcr = chcr | chcr_ts[desc->xfer_shift]; } /*