parisc: Avoid overflow at boundary_size
PATCH 7/7 parisc: Avoid overflow at boundary_size
The boundary_size might be as large as ULONG_MAX, which means that a device has no specific boundary limit. So either "+ 1" or passing it to ALIGN() would potentially overflow.
According to kernel defines:
#define ALIGN_MASK(x, mask) (((x) + (mask)) & ~(mask))
#define ALIGN(x, a) ALIGN_MASK(x, (typeof(x))(a) - 1)We can simplify the logic here:
ALIGN(boundary + 1, 1 << shift) >> shift
= ALIGN_MASK(b + 1, (1 << s) - 1) >> s
= {[b + 1 + (1 << s) - 1] & ~[(1 << s) - 1]} >> s
= [b + 1 + (1 << s) - 1] >> s
= [b + (1 << s)] >> s
= (b >> s) + 1
So fixing a potential overflow with the safer shortcut.
Signed-off-by Nicolin Chen <[email protected]>
Cc Christoph Hellwig <[email protected]>
--- drivers/parisc/ccio-dma.c | 4 ++-- drivers/parisc/sba_iommu.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/parisc/ccio-dma.c +2 -2
@@ -356,8 +356,8 @@ ccio_alloc_range(struct ioc *ioc, struct device *dev, size_t size)** ggg sacrifices another 710 to the computer gods. */ - boundary_size =ALIGN ((unsigned long long )dma_get_seg_boundary (dev) +1 , -1ULL <<IOVP_SHIFT ) >>IOVP_SHIFT ; +/* Overflow-free shortcut for: ALIGN(b + 1, 1 << s) >> s */ + boundary_size = (dma_get_seg_boundary (dev) >>IOVP_SHIFT ) +1 ;if (pages_needed <=8 ) {/*
drivers/parisc/sba_iommu.c +2 -2
@@ -342,8 +342,8 @@ sba_search_bitmap(struct ioc *ioc, struct device *dev,unsigned long shift;int ret; - boundary_size =ALIGN ((unsigned long long )dma_get_seg_boundary (dev) +1 , -1ULL <<IOVP_SHIFT ) >>IOVP_SHIFT ; +/* Overflow-free shortcut for: ALIGN(b + 1, 1 << s) >> s */ + boundary_size = (dma_get_seg_boundary (dev) >>IOVP_SHIFT ) +1 ;#if defined(ZX1_SUPPORT )BUG_ON (ioc->ibase & ~IOVP_MASK );
Signature · 1 line
2.17.1