From patchwork Fri Aug 7 15:42:19 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Allen Hubbe X-Patchwork-Id: 6973041 Return-Path: X-Original-To: patchwork-dmaengine@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id AEE34C05AC for ; Fri, 7 Aug 2015 20:42:43 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 984CB20588 for ; Fri, 7 Aug 2015 20:42:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4862920437 for ; Fri, 7 Aug 2015 20:42:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754009AbbHGUmk (ORCPT ); Fri, 7 Aug 2015 16:42:40 -0400 Received: from mailuogwdur.emc.com ([128.221.224.79]:53204 "EHLO mailuogwdur.emc.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753837AbbHGUmj (ORCPT ); Fri, 7 Aug 2015 16:42:39 -0400 Received: from maildlpprd51.lss.emc.com (maildlpprd51.lss.emc.com [10.106.48.155]) by mailuogwprd52.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id t77KgY7R021556 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 7 Aug 2015 16:42:34 -0400 X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd52.lss.emc.com t77KgY7R021556 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=emc.com; s=jan2013; t=1438980154; bh=Ge4daSGL4dqq5fpUDHL5hXCx84o=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: In-Reply-To:References; b=pw2H/Iw6+kL7OS9b2wUOHyrg+8PiLHCgD9fK3/AI2bLxrIksO2qyxVCcAIhheZgOF 5j8KwagVIF7HRi7lU8+tvXSkkNAPL5dpGx4h7f7b790r7JSEM/kHXX3b/Zk6eBZLCX mIIqAl2AGHgb+w6xqmJ7e6y6GyyPS0v0rcpAN0+Q= X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd52.lss.emc.com t77KgY7R021556 Received: from mailsyshubprd56.lss.emc.com (mailhub.lss.emc.com [10.106.48.138]) by maildlpprd51.lss.emc.com (RSA Interceptor); Fri, 7 Aug 2015 16:42:20 -0400 Received: from HY-R1012-SPA.usd.lab.emc.com.com (hy-r1012-spa.rtp.lab.emc.com [10.6.71.221]) by mailsyshubprd56.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id t77KgP1J022766; Fri, 7 Aug 2015 16:42:26 -0400 From: Allen Hubbe To: Vinod Koul , Dan Williams , Dave Jiang Cc: dmaengine@vger.kernel.org, Allen Hubbe Subject: [PATCH v4 1/2] dmaengine: ioatdma: fix u16 overflow in reshape Date: Fri, 7 Aug 2015 11:42:19 -0400 Message-Id: <8f3a176c1727b1896732946f23e81331906f10e8.1438961324.git.Allen.Hubbe@emc.com> X-Mailer: git-send-email 2.5.0.rc1 In-Reply-To: References: In-Reply-To: References: X-RSA-Classifications: public X-Sentrion-Hostname: mailuogwprd52.lss.emc.com Sender: dmaengine-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: dmaengine@vger.kernel.org X-Spam-Status: No, score=-5.3 required=5.0 tests=BAYES_00, DATE_IN_PAST_03_06, DKIM_SIGNED, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If the allocation order is 16, then the u16 index will overflow and wrap to zero instead of being equal or greater than 1 << 16. The loop condition will always be true, and the loop will run until all the memory resources are depleted. Change the type of index 'i' to u32, so that it is large enough to store a value equal or greater than 1 << 16. Signed-off-by: Allen Hubbe --- drivers/dma/ioat/dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c index a5630966834e..7435585dbbd6 100644 --- a/drivers/dma/ioat/dma.c +++ b/drivers/dma/ioat/dma.c @@ -372,7 +372,7 @@ static bool reshape_ring(struct ioatdma_chan *ioat_chan, int order) const u16 active = ioat_ring_active(ioat_chan); const u32 new_size = 1 << order; struct ioat_ring_ent **ring; - u16 i; + u32 i; if (order > ioat_get_max_alloc_order()) return false;