diff options
author | Dave Jiang <dave.jiang@intel.com> | 2016-07-21 15:40:52 -0400 |
---|---|---|
committer | Vinod Koul <vinod.koul@intel.com> | 2016-08-07 22:32:00 -0400 |
commit | 2eab9b1a3006b4f7bf49c55ce23943170a0068db (patch) | |
tree | 3fe2a110519635d3ede4a271ad6b9feb48be8cab | |
parent | 29b4817d4018df78086157ea3a55c1d9424a7cfc (diff) |
dmaengine: ioatdma: fix uninitialized array usage
Static analysis showed that unitialized array is being used for compare.
At line 850 when a dma_mapping_error() occurs, it jumps to dma_unmap. At
this point, dma_srcs has not been initialized. However, the code after
dma_unmap label checks dma_srcs for a comparison and thus is comparing
to random garbage in the array. Given that when dest_dma is being mapped
this is the first instance of mapping DMA memory and failed, there is
really nothing to be cleaned up and thus should jump to free_resources
label instead.
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
-rw-r--r-- | drivers/dma/ioat/init.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c index 7145f7716a92..015f7110b96d 100644 --- a/drivers/dma/ioat/init.c +++ b/drivers/dma/ioat/init.c | |||
@@ -828,7 +828,7 @@ static int ioat_xor_val_self_test(struct ioatdma_device *ioat_dma) | |||
828 | 828 | ||
829 | dest_dma = dma_map_page(dev, dest, 0, PAGE_SIZE, DMA_FROM_DEVICE); | 829 | dest_dma = dma_map_page(dev, dest, 0, PAGE_SIZE, DMA_FROM_DEVICE); |
830 | if (dma_mapping_error(dev, dest_dma)) | 830 | if (dma_mapping_error(dev, dest_dma)) |
831 | goto dma_unmap; | 831 | goto free_resources; |
832 | 832 | ||
833 | for (i = 0; i < IOAT_NUM_SRC_TEST; i++) | 833 | for (i = 0; i < IOAT_NUM_SRC_TEST; i++) |
834 | dma_srcs[i] = DMA_ERROR_CODE; | 834 | dma_srcs[i] = DMA_ERROR_CODE; |