From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16C4DECDFBB for ; Wed, 18 Jul 2018 12:34:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id BAF4F206B7 for ; Wed, 18 Jul 2018 12:34:33 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org BAF4F206B7 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.de Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730598AbeGRNMP (ORCPT ); Wed, 18 Jul 2018 09:12:15 -0400 Received: from mx2.suse.de ([195.135.220.15]:54516 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726297AbeGRNMP (ORCPT ); Wed, 18 Jul 2018 09:12:15 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay1.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 1D3A4AD5B; Wed, 18 Jul 2018 12:34:30 +0000 (UTC) Date: Wed, 18 Jul 2018 14:34:28 +0200 Message-ID: From: Takashi Iwai To: " He, Bo " Cc: "alsa-devel@alsa-project.org" , "perex@perex.cz" , "linux-kernel@vger.kernel.org" , "Jun Zhang" , "Yanmin Zhang" Subject: Re: [PATCH] ALSA: core: fix unsigned int pages overflow when comapred In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/26 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 18 Jul 2018 13:52:45 +0200, He, Bo wrote: > > we see the below kernel panic on stress suspend resume test in > snd_malloc_sgbuf_pages(), snd_dma_alloc_pages_fallback() alloc > chunk maybe larger than the left pages due to the pages alignment, > which will cause the pages overflow. > > while (pages > 0) { > ... > pages -= chunk; > } > > the patch is change the pages from unsigned int to int to fix the issue. Thanks for the patch. Although the analysis is correct, the fix doesn't look ideal. It's also possible that the returned size may over sgbuf->tblsize if we are more unlucky. A change like below should work instead. Could you give it a try? Takashi -- 8< -- --- a/sound/core/sgbuf.c +++ b/sound/core/sgbuf.c @@ -108,7 +108,7 @@ void *snd_malloc_sgbuf_pages(struct device *device, break; } chunk = tmpb.bytes >> PAGE_SHIFT; - for (i = 0; i < chunk; i++) { + for (i = 0; i < chunk && pages > 0; i++) { table->buf = tmpb.area; table->addr = tmpb.addr; if (!i) @@ -117,9 +117,9 @@ void *snd_malloc_sgbuf_pages(struct device *device, *pgtable++ = virt_to_page(tmpb.area); tmpb.area += PAGE_SIZE; tmpb.addr += PAGE_SIZE; + sgbuf->pages++; + pages--; } - sgbuf->pages += chunk; - pages -= chunk; if (chunk < maxpages) maxpages = chunk; }