Merge tag 'dmaengine-fix-4.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/slave-dma

Pull dmaengine fix from Vinod Koul:
"One small fix for stm32-dmamux fixing buffer overflow"

* tag 'dmaengine-fix-4.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/slave-dma:
dmaengine: stm32-dmamux: fix a potential buffer overflow

Changed files
+6 -3
drivers
+6 -3
drivers/dma/stm32-dmamux.c
··· 118 118 spin_lock_irqsave(&dmamux->lock, flags); 119 119 mux->chan_id = find_first_zero_bit(dmamux->dma_inuse, 120 120 dmamux->dma_requests); 121 - set_bit(mux->chan_id, dmamux->dma_inuse); 122 - spin_unlock_irqrestore(&dmamux->lock, flags); 123 121 124 122 if (mux->chan_id == dmamux->dma_requests) { 123 + spin_unlock_irqrestore(&dmamux->lock, flags); 125 124 dev_err(&pdev->dev, "Run out of free DMA requests\n"); 126 125 ret = -ENOMEM; 127 - goto error; 126 + goto error_chan_id; 128 127 } 128 + set_bit(mux->chan_id, dmamux->dma_inuse); 129 + spin_unlock_irqrestore(&dmamux->lock, flags); 129 130 130 131 /* Look for DMA Master */ 131 132 for (i = 1, min = 0, max = dmamux->dma_reqs[i]; ··· 174 173 175 174 error: 176 175 clear_bit(mux->chan_id, dmamux->dma_inuse); 176 + 177 + error_chan_id: 177 178 kfree(mux); 178 179 return ERR_PTR(ret); 179 180 }