From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756077AbbIYMQA (ORCPT ); Fri, 25 Sep 2015 08:16:00 -0400 Received: from eu-smtp-delivery-143.mimecast.com ([146.101.78.143]:32693 "EHLO eu-smtp-delivery-143.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755619AbbIYMP5 (ORCPT ); Fri, 25 Sep 2015 08:15:57 -0400 From: Robin Murphy To: akpm@linux-foundation.org, linux-kernel@vger.kernel.org Cc: arnd@arndb.de, m.szyprowski@samsung.com, sumit.semwal@linaro.org, sakari.ailus@iki.fi, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-arm-kernel@lists.infradead.org Subject: [PATCH 1/4] dmapool: Fix overflow condition in pool_find_page Date: Fri, 25 Sep 2015 13:15:43 +0100 Message-Id: X-Mailer: git-send-email 1.9.1 In-Reply-To: References: X-OriginalArrivalTime: 25 Sep 2015 12:15:54.0068 (UTC) FILETIME=[ECE4D940:01D0F78B] X-MC-Unique: tcEVQg9GQ4SrgnHPXUHxMw-3 Content-Type: text/plain; charset=WINDOWS-1252 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by mail.home.local id t8PCG4lW029242 If a DMA pool lies at the very top of the dma_addr_t range (as may happen with an IOMMU involved), the calculated end address of the pool wraps around to zero, and page lookup always fails. Tweak the relevant calculation to be overflow-proof. Signed-off-by: Robin Murphy --- mm/dmapool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/dmapool.c b/mm/dmapool.c index 71a8998..312a716 100644 --- a/mm/dmapool.c +++ b/mm/dmapool.c @@ -394,7 +394,7 @@ static struct dma_page *pool_find_page(struct dma_pool *pool, dma_addr_t dma) list_for_each_entry(page, &pool->page_list, page_list) { if (dma < page->dma) continue; - if (dma < (page->dma + pool->allocation)) + if ((dma - page->dma) < pool->allocation) return page; } return NULL; -- 1.9.1