linux-kernel - [PATCH] fix off-by-one error in dma

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Wed, 14 Oct 2009 17:12:57 +0100
From:	"Jan Beulich" <JBeulich@...ell.com>
To:	<linux-kernel@...r.kernel.org>
Cc:	<beckyb@...nel.crashing.org>, <fujita.tomonori@....ntt.co.jp>,
	"Andrew Morton" <akpm@...ux-foundation.org>
Subject: [PATCH] fix off-by-one error in dma_capable()

dma_mask is, when interpreted as address, the last valid byte, and
hence comparison msut also be done using the last valid of the buffer
in question.

Also fix the open-coded instances in lib/swiotlb.c.

Signed-off-by: Jan Beulich <jbeulich@...ell.com>
Cc: FUJITA Tomonori <fujita.tomonori@....ntt.co.jp>
Cc: Becky Bruce <beckyb@...nel.crashing.org>

---
 arch/ia64/include/asm/dma-mapping.h    |    2 +-
 arch/powerpc/include/asm/dma-mapping.h |    2 +-
 arch/x86/include/asm/dma-mapping.h     |    2 +-
 lib/swiotlb.c                          |    4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

--- linux-2.6.32-rc4/arch/ia64/include/asm/dma-mapping.h	2009-10-12 10:07:47.000000000 +0200
+++ 2.6.32-rc4-dma-capable/arch/ia64/include/asm/dma-mapping.h	2009-10-14 11:58:11.000000000 +0200
@@ -73,7 +73,7 @@ static inline bool dma_capable(struct de
 	if (!dev->dma_mask)
 		return 0;
 
-	return addr + size <= *dev->dma_mask;
+	return addr + size - 1 <= *dev->dma_mask;
 }
 
 static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr)
--- linux-2.6.32-rc4/arch/powerpc/include/asm/dma-mapping.h	2009-10-12 10:07:50.000000000 +0200
+++ 2.6.32-rc4-dma-capable/arch/powerpc/include/asm/dma-mapping.h	2009-10-14 11:58:40.000000000 +0200
@@ -197,7 +197,7 @@ static inline bool dma_capable(struct de
 	if (!dev->dma_mask)
 		return 0;
 
-	return addr + size <= *dev->dma_mask;
+	return addr + size - 1 <= *dev->dma_mask;
 }
 
 static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr)
--- linux-2.6.32-rc4/arch/x86/include/asm/dma-mapping.h	2009-10-12 10:07:56.000000000 +0200
+++ 2.6.32-rc4-dma-capable/arch/x86/include/asm/dma-mapping.h	2009-10-14 11:57:38.000000000 +0200
@@ -60,7 +60,7 @@ static inline bool dma_capable(struct de
 	if (!dev->dma_mask)
 		return 0;
 
-	return addr + size <= *dev->dma_mask;
+	return addr + size - 1 <= *dev->dma_mask;
 }
 
 static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr)
--- linux-2.6.32-rc4/lib/swiotlb.c	2009-10-12 10:08:48.000000000 +0200
+++ 2.6.32-rc4-dma-capable/lib/swiotlb.c	2009-10-14 11:55:26.000000000 +0200
@@ -517,7 +517,7 @@ swiotlb_alloc_coherent(struct device *hw
 		dma_mask = hwdev->coherent_dma_mask;
 
 	ret = (void *)__get_free_pages(flags, order);
-	if (ret && swiotlb_virt_to_bus(hwdev, ret) + size > dma_mask) {
+	if (ret && swiotlb_virt_to_bus(hwdev, ret) + size - 1 > dma_mask) {
 		/*
 		 * The allocated memory isn't reachable by the device.
 		 */
@@ -539,7 +539,7 @@ swiotlb_alloc_coherent(struct device *hw
 	dev_addr = swiotlb_virt_to_bus(hwdev, ret);
 
 	/* Confirm address can be DMA'd by device */
-	if (dev_addr + size > dma_mask) {
+	if (dev_addr + size - 1 > dma_mask) {
 		printk("hwdev DMA mask = 0x%016Lx, dev_addr = 0x%016Lx\n",
 		       (unsigned long long)dma_mask,
 		       (unsigned long long)dev_addr);



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/