Commit 5b5dc7db authored by Gabor Juhos's avatar Gabor Juhos Committed by Miquel Raynal
Browse files

mtd: nand: qpic_common: use {cmd,data}_sgl_nitems for sg_init_table() 



Since commit ddaad4ad ("mtd: nand: qpic_common: prevent out of
bounds access of BAM arrays"), the {cmd,data}_sgl_nitems members in
the 'bam_transaction' structure are containing the number of elements
in the cmd/data scatter-gather lists.

Change the qcom_clear_bam_transaction() function to use these numbers
while reinitializing the sg lists instead of recomputing the number of
elements to make it less error prone.

Signed-off-by: default avatarGabor Juhos <j4g8y7@gmail.com>
Acked-by: default avatarKonrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: default avatarMiquel Raynal <miquel.raynal@bootlin.com>
parent 3ea299d3

drivers/mtd/nand/qpic_common.c

+2 −4
Original line number Diff line number Diff line
@@ -89,10 +89,8 @@ void qcom_clear_bam_transaction(struct qcom_nand_controller *nandc) 
	memset(&bam_txn->bam_positions, 0, sizeof(bam_txn->bam_positions));

	bam_txn->last_data_desc = NULL;



	sg_init_table(bam_txn->cmd_sgl, nandc->max_cwperpage *

		      QPIC_PER_CW_CMD_SGL);

	sg_init_table(bam_txn->data_sgl, nandc->max_cwperpage *

		      QPIC_PER_CW_DATA_SGL);

	sg_init_table(bam_txn->cmd_sgl, bam_txn->cmd_sgl_nitems);

	sg_init_table(bam_txn->data_sgl, bam_txn->data_sgl_nitems);



	reinit_completion(&bam_txn->txn_done);

}