Messages in this thread Patch in this message | | | Date | Fri, 6 Feb 2009 13:22:33 +0100 (CET) | From | Guennadi Liakhovetski <> | Subject | [PATCH] fix broken size test in bitmap_find_free_region() |
| |
This loop and test in bitmap_find_free_region()
for (pos = 0; pos < bits; pos += (1 << order)) if (__reg_op(bitmap, pos, order, REG_OP_ISFREE)) break; if (pos == bits) return -ENOMEM;
can only return an error (-ENOMEM) if bits is a multiple of (1 << order), which is, for instance, true, if bits is (also) a power of 2. This is not necessarily the case with dma_alloc_from_coherent(). A failure to recognise too large a request leads in dma_alloc_from_coherent() to accessing beyond available memory, and to writing beyond the bitmap.
Signed-off-by: Guennadi Liakhovetski <lg@denx.de> ---
diff --git a/lib/bitmap.c b/lib/bitmap.c index 1338469..d49c37f 100644 --- a/lib/bitmap.c +++ b/lib/bitmap.c @@ -953,7 +953,7 @@ int bitmap_find_free_region(unsigned long *bitmap, int bits, int order) for (pos = 0; pos < bits; pos += (1 << order)) if (__reg_op(bitmap, pos, order, REG_OP_ISFREE)) break; - if (pos == bits) + if (pos + (1 << order) > bits) return -ENOMEM; __reg_op(bitmap, pos, order, REG_OP_ALLOC); return pos;
| |