Messages in this thread | | | Date | Fri, 6 Feb 2009 13:29:50 -0800 | From | Andrew Morton <> | Subject | Re: [PATCH] fix broken size test in bitmap_find_free_region() |
| |
On Fri, 6 Feb 2009 13:22:33 +0100 (CET) Guennadi Liakhovetski <lg@denx.de> wrote:
> This loop and test in bitmap_find_free_region() > > for (pos = 0; pos < bits; pos += (1 << order)) > if (__reg_op(bitmap, pos, order, REG_OP_ISFREE)) > break; > if (pos == bits) > return -ENOMEM; > > can only return an error (-ENOMEM) if bits is a multiple of (1 << order), > which is, for instance, true, if bits is (also) a power of 2. This > is not necessarily the case with dma_alloc_from_coherent(). A failure to > recognise too large a request leads in dma_alloc_from_coherent() to > accessing beyond available memory, and to writing beyond the bitmap. >
Do we have any reports of dma_alloc_from_coherent() actually behaving in that way?
> --- > > diff --git a/lib/bitmap.c b/lib/bitmap.c > index 1338469..d49c37f 100644 > --- a/lib/bitmap.c > +++ b/lib/bitmap.c > @@ -953,7 +953,7 @@ int bitmap_find_free_region(unsigned long *bitmap, int bits, int order) > for (pos = 0; pos < bits; pos += (1 << order)) > if (__reg_op(bitmap, pos, order, REG_OP_ISFREE)) > break; > - if (pos == bits) > + if (pos + (1 << order) > bits) > return -ENOMEM; > __reg_op(bitmap, pos, order, REG_OP_ALLOC); > return pos;
| |