lkml.org 
[lkml]   [2015]   [Oct]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 011/123] iommu/amd: Handle integer overflow in dma_ops_area_alloc
    Date
    From: Joerg Roedel <jroedel@suse.de>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit e6aabee05f41c9d18e0b92194819edd84f352ac9 upstream.

    Handle this case to make sure boundary_size does not become
    0 and trigger a BUG_ON later.

    Signed-off-by: Joerg Roedel <jroedel@suse.de>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    drivers/iommu/amd_iommu.c | 8 +++++---
    1 file changed, 5 insertions(+), 3 deletions(-)

    diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
    index b853bb47fc7d..d22b4af761f5 100644
    --- a/drivers/iommu/amd_iommu.c
    +++ b/drivers/iommu/amd_iommu.c
    @@ -1750,14 +1750,16 @@ static unsigned long dma_ops_area_alloc(struct device *dev,
    unsigned long next_bit = dom->next_address % APERTURE_RANGE_SIZE;
    int max_index = dom->aperture_size >> APERTURE_RANGE_SHIFT;
    int i = start >> APERTURE_RANGE_SHIFT;
    - unsigned long boundary_size;
    + unsigned long boundary_size, mask;
    unsigned long address = -1;
    unsigned long limit;

    next_bit >>= PAGE_SHIFT;

    - boundary_size = ALIGN(dma_get_seg_boundary(dev) + 1,
    - PAGE_SIZE) >> PAGE_SHIFT;
    + mask = dma_get_seg_boundary(dev);
    +
    + boundary_size = mask + 1 ? ALIGN(mask + 1, PAGE_SIZE) >> PAGE_SHIFT :
    + 1UL << (BITS_PER_LONG - PAGE_SHIFT);

    for (;i < max_index; ++i) {
    unsigned long offset = dom->aperture[i]->offset >> PAGE_SHIFT;
    --
    2.6.2


    \
     
     \ /
      Last update: 2015-10-28 16:01    [W:2.136 / U:0.368 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site