lkml.org 
[lkml]   [2009]   [Feb]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] fix broken size test in bitmap_find_free_region()
    On Fri, 6 Feb 2009 13:22:33 +0100 (CET)
    Guennadi Liakhovetski <lg@denx.de> wrote:

    > This loop and test in bitmap_find_free_region()
    >
    > for (pos = 0; pos < bits; pos += (1 << order))
    > if (__reg_op(bitmap, pos, order, REG_OP_ISFREE))
    > break;
    > if (pos == bits)
    > return -ENOMEM;
    >
    > can only return an error (-ENOMEM) if bits is a multiple of (1 << order),
    > which is, for instance, true, if bits is (also) a power of 2. This
    > is not necessarily the case with dma_alloc_from_coherent(). A failure to
    > recognise too large a request leads in dma_alloc_from_coherent() to
    > accessing beyond available memory, and to writing beyond the bitmap.
    >

    Do we have any reports of dma_alloc_from_coherent() actually behaving
    in that way?


    > ---
    >
    > diff --git a/lib/bitmap.c b/lib/bitmap.c
    > index 1338469..d49c37f 100644
    > --- a/lib/bitmap.c
    > +++ b/lib/bitmap.c
    > @@ -953,7 +953,7 @@ int bitmap_find_free_region(unsigned long *bitmap, int bits, int order)
    > for (pos = 0; pos < bits; pos += (1 << order))
    > if (__reg_op(bitmap, pos, order, REG_OP_ISFREE))
    > break;
    > - if (pos == bits)
    > + if (pos + (1 << order) > bits)
    > return -ENOMEM;
    > __reg_op(bitmap, pos, order, REG_OP_ALLOC);
    > return pos;


    \
     
     \ /
      Last update: 2009-02-06 22:33    [W:0.022 / U:32.572 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site