瀏覽代碼

dmaengine: ioatdma: fix uninitialized array usage

Static analysis showed that unitialized array is being used for compare.
At line 850 when a dma_mapping_error() occurs, it jumps to dma_unmap. At
this point, dma_srcs has not been initialized. However, the code after
dma_unmap label checks dma_srcs for a comparison and thus is comparing
to random garbage in the array. Given that when dest_dma is being mapped
this is the first instance of mapping DMA memory and failed, there is
really nothing to be cleaned up and thus should jump to free_resources
label instead.

Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Dave Jiang 9 年之前
父節點
當前提交
2eab9b1a30
共有 1 個文件被更改,包括 1 次插入1 次删除
  1. 1 1
      drivers/dma/ioat/init.c

+ 1 - 1
drivers/dma/ioat/init.c

@@ -828,7 +828,7 @@ static int ioat_xor_val_self_test(struct ioatdma_device *ioat_dma)
 
 
 	dest_dma = dma_map_page(dev, dest, 0, PAGE_SIZE, DMA_FROM_DEVICE);
 	dest_dma = dma_map_page(dev, dest, 0, PAGE_SIZE, DMA_FROM_DEVICE);
 	if (dma_mapping_error(dev, dest_dma))
 	if (dma_mapping_error(dev, dest_dma))
-		goto dma_unmap;
+		goto free_resources;
 
 
 	for (i = 0; i < IOAT_NUM_SRC_TEST; i++)
 	for (i = 0; i < IOAT_NUM_SRC_TEST; i++)
 		dma_srcs[i] = DMA_ERROR_CODE;
 		dma_srcs[i] = DMA_ERROR_CODE;