diff options
| author | Joerg Roedel <jroedel@suse.de> | 2015-05-27 09:26:09 +0200 |
|---|---|---|
| committer | Joerg Roedel <jroedel@suse.de> | 2015-05-29 11:18:01 +0200 |
| commit | e6aabee05f41c9d18e0b92194819edd84f352ac9 (patch) | |
| tree | afb4e60a376b680d810d4cd5668907eb3ed135c7 /drivers/iommu | |
| parent | d4b036648402bb4ef6d4a0df51375a2fb705b6cc (diff) | |
| download | op-kernel-dev-e6aabee05f41c9d18e0b92194819edd84f352ac9.zip op-kernel-dev-e6aabee05f41c9d18e0b92194819edd84f352ac9.tar.gz | |
iommu/amd: Handle integer overflow in dma_ops_area_alloc
Handle this case to make sure boundary_size does not become
0 and trigger a BUG_ON later.
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Diffstat (limited to 'drivers/iommu')
| -rw-r--r-- | drivers/iommu/amd_iommu.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c index aa710b0..4dfadcf 100644 --- a/drivers/iommu/amd_iommu.c +++ b/drivers/iommu/amd_iommu.c @@ -1699,14 +1699,16 @@ static unsigned long dma_ops_area_alloc(struct device *dev, unsigned long next_bit = dom->next_address % APERTURE_RANGE_SIZE; int max_index = dom->aperture_size >> APERTURE_RANGE_SHIFT; int i = start >> APERTURE_RANGE_SHIFT; - unsigned long boundary_size; + unsigned long boundary_size, mask; unsigned long address = -1; unsigned long limit; next_bit >>= PAGE_SHIFT; - boundary_size = ALIGN(dma_get_seg_boundary(dev) + 1, - PAGE_SIZE) >> PAGE_SHIFT; + mask = dma_get_seg_boundary(dev); + + boundary_size = mask + 1 ? ALIGN(mask + 1, PAGE_SIZE) >> PAGE_SHIFT : + 1UL << (BITS_PER_LONG - PAGE_SHIFT); for (;i < max_index; ++i) { unsigned long offset = dom->aperture[i]->offset >> PAGE_SHIFT; |
