Commit 676bd991 authored Oct 01, 2015 by Robin Murphy Committed by Linus Torvalds Oct 01, 2015

dmapool: fix overflow condition in pool_find_page()



If a DMA pool lies at the very top of the dma_addr_t range (as may
happen with an IOMMU involved), the calculated end address of the pool
wraps around to zero, and page lookup always fails.

Tweak the relevant calculation to be overflow-proof.

Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Sakari Ailus <sakari.ailus@iki.fi>
Cc: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 44241628

mm/dmapool.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -394,7 +394,7 @@ static struct dma_page pool_find_page(struct dma_pool pool, dma_addr_t dma)
		list_for_each_entry(page, &pool->page_list, page_list) {
		if (dma < page->dma)
		continue;
		if (dma < (page->dma + pool->allocation))
		if ((dma - page->dma) < pool->allocation)
		return page;
		}
		return NULL;

Admin message