diff mbox

[v4,1/2] dmaengine: ioatdma: fix u16 overflow in reshape

Message ID 8f3a176c1727b1896732946f23e81331906f10e8.1438961324.git.Allen.Hubbe@emc.com (mailing list archive)
State Superseded
Headers show

Commit Message

Allen Hubbe Aug. 7, 2015, 3:42 p.m. UTC 
If the allocation order is 16, then the u16 index will overflow and wrap
to zero instead of being equal or greater than 1 << 16.  The loop
condition will always be true, and the loop will run until all the
memory resources are depleted.

Change the type of index 'i' to u32, so that it is large enough to store
a value equal or greater than 1 << 16.

Signed-off-by: Allen Hubbe <Allen.Hubbe@emc.com>
---
 drivers/dma/ioat/dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox

Patch

diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index a5630966834e..7435585dbbd6 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -372,7 +372,7 @@  static bool reshape_ring(struct ioatdma_chan *ioat_chan, int order)
 	const u16 active = ioat_ring_active(ioat_chan);
 	const u32 new_size = 1 << order;
 	struct ioat_ring_ent **ring;
-	u16 i;
+	u32 i;
 
 	if (order > ioat_get_max_alloc_order())
 		return false;