Skip to content

Commit 0c0eb4c

Browse files
x-y-zVinod Koul
authored andcommitted
dmaengine: avoid map_cnt overflow with CONFIG_DMA_ENGINE_RAID
When CONFIG_DMA_ENGINE_RAID is enabled, unmap pool size can reach to 256. But in struct dmaengine_unmap_data, map_cnt is only u8, wrapping to 0, if the unmap pool is maximally used. This triggers BUG() when struct dmaengine_unmap_data is freed. Use u16 to fix the problem. Signed-off-by: Zi Yan <[email protected]> Signed-off-by: Vinod Koul <[email protected]>
1 parent 7928b2c commit 0c0eb4c

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

include/linux/dmaengine.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -470,7 +470,11 @@ typedef void (*dma_async_tx_callback_result)(void *dma_async_param,
470470
const struct dmaengine_result *result);
471471

472472
struct dmaengine_unmap_data {
473+
#if IS_ENABLED(CONFIG_DMA_ENGINE_RAID)
474+
u16 map_cnt;
475+
#else
473476
u8 map_cnt;
477+
#endif
474478
u8 to_cnt;
475479
u8 from_cnt;
476480
u8 bidi_cnt;

0 commit comments

Comments
 (0)