Skip to contentSkip to conversation

iommu/amd: Handle integer overflow in dma_ops_area_alloc

PATCH New Joerg Roedel 1 participant 1 message May 27, 2015 IOMMU

lore
Share & tools
lore

Joerg Roedel

author maintainer
#0 lore raw

PATCH 1/1 iommu/amd: Handle integer overflow in dma_ops_area_alloc

From: Joerg Roedel <[email protected]>

Handle this case to make sure boundary_size does not become 0 and trigger a BUG_ON later.

Signed-off-by Joerg Roedel <[email protected]>
---
 drivers/iommu/amd_iommu.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/iommu/amd_iommu.c +5 -3
index e43d489..f2d12c0 100644
@@ -1704,14 +1704,16 @@ static unsigned long dma_ops_area_alloc(struct device *dev,
 	unsigned long next_bit = dom->next_address % APERTURE_RANGE_SIZE;
 	int max_index = dom->aperture_size >> APERTURE_RANGE_SHIFT;
 	int i = start >> APERTURE_RANGE_SHIFT;
-	unsigned long boundary_size;
+	unsigned long boundary_size, mask;
 	unsigned long address = -1;
 	unsigned long limit;
 
 	next_bit >>= PAGE_SHIFT;
 
-	boundary_size = ALIGN(dma_get_seg_boundary(dev) + 1,
-			PAGE_SIZE) >> PAGE_SHIFT;
+	mask = dma_get_seg_boundary(dev);
+
+	boundary_size = mask + 1 ? ALIGN(mask + 1, PAGE_SIZE) >> PAGE_SHIFT :
+				   1UL << (BITS_PER_LONG - PAGE_SHIFT);
 
 	for (;i < max_index; ++i) {
 		unsigned long offset = dom->aperture[i]->offset >> PAGE_SHIFT;
Signature · 1 line
1.9.1