From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753510AbbHEVlX (ORCPT ); Wed, 5 Aug 2015 17:41:23 -0400 Received: from mailuogwdur.emc.com ([128.221.224.79]:25500 "EHLO mailuogwdur.emc.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752454AbbHEVlT (ORCPT ); Wed, 5 Aug 2015 17:41:19 -0400 X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd51.lss.emc.com t75LfGmL013873 X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd51.lss.emc.com t75LfGmL013873 From: Allen Hubbe To: Dan Williams , Dave Jiang Cc: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org, Allen Hubbe Subject: [PATCH v3 1/2] ioatdma: fix overflow of u16 in ring_reshape Date: Wed, 5 Aug 2015 12:40:59 -0400 Message-Id: <7fb27a69349e6a5fc6006752104de90c64cb27d2.1438792694.git.Allen.Hubbe@emc.com> X-Mailer: git-send-email 2.5.0.rc1 In-Reply-To: References: In-Reply-To: References: X-RSA-Classifications: public X-Sentrion-Hostname: mailuogwprd51.lss.emc.com Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If the allocation order is 16, then the u16 index will overflow and wrap to zero instead of being equal or greater than 1 << 16. The loop condition will always be true, and the loop will run until all the memory resources are depleted. Change the type of index 'i' to u32, so that it is large enough to store a value equal or greater than 1 << 16. Signed-off-by: Allen Hubbe --- drivers/dma/ioat/dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c index a5630966834e..7435585dbbd6 100644 --- a/drivers/dma/ioat/dma.c +++ b/drivers/dma/ioat/dma.c @@ -372,7 +372,7 @@ static bool reshape_ring(struct ioatdma_chan *ioat_chan, int order) const u16 active = ioat_ring_active(ioat_chan); const u32 new_size = 1 << order; struct ioat_ring_ent **ring; - u16 i; + u32 i; if (order > ioat_get_max_alloc_order()) return false; -- 2.5.0.rc1