Messages in this thread | | | Date | Tue, 27 Jan 2009 13:48:31 -0800 | From | Andrew Morton <> | Subject | Re: [PATCH] dma: fix up broken comparison in dma_alloc_from_coherent |
| |
On Wed, 21 Jan 2009 17:11:19 +0900 Paul Mundt <lethal@linux-sh.org> wrote:
> @@ -118,31 +118,32 @@ int dma_alloc_from_coherent(struct device *dev, ssize_t size, > mem = dev->dma_mem; > if (!mem) > return 0; > - if (unlikely(size > mem->size)) > - return 0; > + > + *ret = NULL; > + > + if (unlikely(size > (mem->size << PAGE_SHIFT))) > + goto err;
Looks a bit broken on 64-bit.
`size' is ssize_t (long).
`mem->size' is `int'.
The left shift can overflow and cause badnesses.
> + *dma_handle = mem->device_base + (pageno << PAGE_SHIFT); > + *ret = mem->virt_base + (pageno << PAGE_SHIFT);
Ditto.
Maybe it's a can't-happen (why?), but...
| |