Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1258216

[PATCH 3.12 011/123] iommu/amd: Handle integer overflow in dma_ops_area_alloc

Show all headers | View raw

From: Joerg Roedel <jroedel@suse.de>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit e6aabee05f41c9d18e0b92194819edd84f352ac9 upstream.

Handle this case to make sure boundary_size does not become
0 and trigger a BUG_ON later.

Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/iommu/amd_iommu.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index b853bb47fc7d..d22b4af761f5 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -1750,14 +1750,16 @@ static unsigned long dma_ops_area_alloc(struct device *dev,
 	unsigned long next_bit = dom->next_address % APERTURE_RANGE_SIZE;
 	int max_index = dom->aperture_size >> APERTURE_RANGE_SHIFT;
 	int i = start >> APERTURE_RANGE_SHIFT;
-	unsigned long boundary_size;
+	unsigned long boundary_size, mask;
 	unsigned long address = -1;
 	unsigned long limit;
 
 	next_bit >>= PAGE_SHIFT;
 
-	boundary_size = ALIGN(dma_get_seg_boundary(dev) + 1,
-			PAGE_SIZE) >> PAGE_SHIFT;
+	mask = dma_get_seg_boundary(dev);
+
+	boundary_size = mask + 1 ? ALIGN(mask + 1, PAGE_SIZE) >> PAGE_SHIFT :
+				   1UL << (BITS_PER_LONG - PAGE_SHIFT);
 
 	for (;i < max_index; ++i) {
 		unsigned long offset = dom->aperture[i]->offset >> PAGE_SHIFT;
-- 
2.6.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.12 001/123] x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:00 +0100
  [PATCH 3.12 027/123] ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:00 +0100
  [PATCH 3.12 035/123] arc,hexagon: Delete asm/barrier.h Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:00 +0100
  [PATCH 3.12 037/123] spi: Fix documentation of spi_alloc_master() Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:00 +0100
  [PATCH 3.12 029/123] x86/apic: Serialize LVTT and TSC_DEADLINE writes Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:00 +0100
  [PATCH 3.12 026/123] windfarm: decrement client count when unregistering Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:00 +0100
  [PATCH 3.12 021/123] perf stat: Get correct cpu id for print_aggr Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
  [PATCH 3.12 030/123] x86/platform: Fix Geode LX timekeeping in the generic x86 build Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
  [PATCH 3.12 031/123] x86/mm: Set NX on gap between __ex_table and rodata Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
  [PATCH 3.12 033/123] arch: Clean up asm/barrier.h implementations using asm-generic/barrier.h Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
  [PATCH 3.12 032/123] x86/xen: Support kexec/kdump in HVM guests by doing a soft reset Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
    Re: [PATCH 3.12 032/123] x86/xen: Support kexec/kdump in HVM guests  by doing a soft reset Luis Henriques <luis.henriques@canonical.com> - 2015-10-28 16:30 +0100
      Re: [PATCH 3.12 032/123] x86/xen: Support kexec/kdump in HVM guests  by doing a soft reset Jiri Slaby <jslaby@suse.cz> - 2015-10-28 16:40 +0100
  [PATCH 3.12 022/123] perf header: Fixup reading of HEADER_NRCPUS feature Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
  [PATCH 3.12 034/123] arch: Move smp_mb__{before,after}_atomic_{inc,dec}.h into asm/atomic.h Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
  [PATCH 3.12 025/123] ARM: 8429/1: disable GCC SRA optimization Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
  [PATCH 3.12 028/123] dmaengine: dw: properly read DWC_PARAMS register Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
  [PATCH 3.12 014/123] ARM: 7880/1: Clear the IT state independent of the Thumb-2 mode Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 036/123] sched/core: Fix TASK_DEAD race in finish_task_switch() Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 012/123] s390/3270: redraw screen on unsolicited device end Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 013/123] Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 023/123] hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 017/123] kvm: fix zero length mmio searching Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 018/123] scsi: fix scsi_error_handler vs. scsi_host_dev_release race Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 002/123] x86/paravirt: Replace the paravirt nop with a bona fide empty function Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 020/123] perf hists: Update the column width for the "srcline" sort key Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 019/123] iser-target: remove command with state ISTATE_REMOVE Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 024/123] ARM: fix Thumb2 signal handling when ARMv6 is enabled Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 016/123] ALSA: hda - Control SPDIF out pin on MacBookPro 11,2 Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 015/123] net: add length argument to skb_copy_and_csum_datagram_iovec Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
  [PATCH 3.12 004/123] rcu: Reject memory-order-induced stall-warning false positives Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
  [PATCH 3.12 005/123] sched: Fix cpu_active_mask/cpu_online_mask race Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
  [PATCH 3.12 007/123] xhci: rework cycle bit checking for new dequeue pointers Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
  [PATCH 3.12 006/123] xhci: Workaround for PME stuck issues in Intel xhci Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
  [PATCH 3.12 009/123] USB: usbtmc: add device quirk for Rigol DS6104 Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
    Re: [PATCH 3.12 009/123] USB: usbtmc: add device quirk for Rigol DS6104 Teunis van Beelen <teuniz@gmail.com> - 2015-10-28 16:40 +0100
  [PATCH 3.12 008/123] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
  [PATCH 3.12 010/123] client MUST ignore EncryptionKeyLength if CAP_EXTENDED_SECURITY is set Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
  [PATCH 3.12 011/123] iommu/amd: Handle integer overflow in dma_ops_area_alloc Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
  [PATCH 3.12 003/123] jbd2: avoid infinite loop when destroying aborted journal Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100

csiph-web