Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934338AbeAHPuy (ORCPT + 1 other); Mon, 8 Jan 2018 10:50:54 -0500 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:41021 "EHLO out3-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934262AbeAHPuw (ORCPT ); Mon, 8 Jan 2018 10:50:52 -0500 X-ME-Sender: From: Zi Yan To: dmaengine@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Zi Yan , Vinod Koul , Dan Williams Subject: [PATCH] dmaengine: avoid map_cnt overflow with CONFIG_DMA_ENGINE_RAID Date: Mon, 8 Jan 2018 10:50:50 -0500 Message-Id: <20180108155050.7387-1-zi.yan@sent.com> X-Mailer: git-send-email 2.15.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: From: Zi Yan When CONFIG_DMA_ENGINE_RAID is enabled, unmap pool size can reach to 256. But in struct dmaengine_unmap_data, map_cnt is only u8, wrapping to 0, if the unmap pool is maximally used. This triggers BUG() when struct dmaengine_unmap_data is freed. Use u16 to fix the problem. Signed-off-by: Zi Yan --- include/linux/dmaengine.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h index f838764993eb..861be5cab1df 100644 --- a/include/linux/dmaengine.h +++ b/include/linux/dmaengine.h @@ -470,7 +470,11 @@ typedef void (*dma_async_tx_callback_result)(void *dma_async_param, const struct dmaengine_result *result); struct dmaengine_unmap_data { +#if IS_ENABLED(CONFIG_DMA_ENGINE_RAID) + u16 map_cnt; +#else u8 map_cnt; +#endif u8 to_cnt; u8 from_cnt; u8 bidi_cnt; -- 2.15.1