From: Allen Hubbe <Allen.Hubbe@emc.com>
To: Dan Williams <dan.j.williams@intel.com>,
Dave Jiang <dave.jiang@intel.com>
Cc: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org,
Allen Hubbe <Allen.Hubbe@emc.com>
Subject: [PATCH v2] ioatdma: fix overflow of u16 in ring_reshape
Date: Wed, 5 Aug 2015 10:55:04 -0400 [thread overview]
Message-ID: <7fb27a69349e6a5fc6006752104de90c64cb27d2.1438781843.git.Allen.Hubbe@emc.com> (raw)
If the allocation order is 16, then the u16 index will overflow and wrap
to zero instead of being equal or greater than 1 << 16. The loop
condition will always be true, and the loop will run until all the
memory resources are depleted.
Change the type of index 'i' to u32, so that it is large enough to store
a value equal or greater than 1 << 16.
Signed-off-by: Allen Hubbe <Allen.Hubbe@emc.com>
---
Version Two: rebased the fix on top of Dave Jiang's work.
drivers/dma/ioat/dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index a5630966834e..7435585dbbd6 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -372,7 +372,7 @@ static bool reshape_ring(struct ioatdma_chan *ioat_chan, int order)
const u16 active = ioat_ring_active(ioat_chan);
const u32 new_size = 1 << order;
struct ioat_ring_ent **ring;
- u16 i;
+ u32 i;
if (order > ioat_get_max_alloc_order())
return false;
--
2.5.0.rc1
next reply other threads:[~2015-08-05 19:55 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-05 14:55 Allen Hubbe [this message]
2015-08-05 20:03 ` Dan Williams
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7fb27a69349e6a5fc6006752104de90c64cb27d2.1438781843.git.Allen.Hubbe@emc.com \
--to=allen.hubbe@emc.com \
--cc=dan.j.williams@intel.com \
--cc=dave.jiang@intel.com \
--cc=dmaengine@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®