linux-kernel - [PATCH] ARM: mm: fix the boundary checking on bitmaps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1404959313-15198-1-git-send-email-haojian.zhuang@linaro.org>
Date:	Thu, 10 Jul 2014 10:28:33 +0800
From:	Haojian Zhuang <haojian.zhuang@...aro.org>
To:	linux@....linux.org.uk, m.szyprowski@...sung.com,
	will.deacon@....com, andreas.herrmann@...xeda.com,
	linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Cc:	Haojian Zhuang <haojian.zhuang@...aro.org>
Subject: [PATCH] ARM: mm: fix the boundary checking on bitmaps

The issue of boundary checking on bitmaps is introduced by this commit
in below.

commit 4d852ef8c2544ce21ae41414099a7504c61164a0
Author: Andreas Herrmann <andreas.herrmann@...xeda.com>
Date:   Tue Feb 25 13:09:53 2014 +0100

    arm: dma-mapping: Add support to extend DMA IOMMU mappings

Multiple bitmaps were introduced as extension. If it needs to extend
a bitmap, it still check whether the allocation exceeding the total
size, not current bitmap size. So change the condition from
mapping->bits to PAGE_SIZE.

Signed-off-by: Haojian Zhuang <haojian.zhuang@...aro.org>
---
 arch/arm/mm/dma-mapping.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 4c88935..d7da5c3 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1089,9 +1089,9 @@ static inline dma_addr_t __alloc_iova(struct dma_iommu_mapping *mapping,
 	spin_lock_irqsave(&mapping->lock, flags);
 	for (i = 0; i < mapping->nr_bitmaps; i++) {
 		start = bitmap_find_next_zero_area(mapping->bitmaps[i],
-				mapping->bits, 0, count, align);
+				PAGE_SIZE, 0, count, align);
 
-		if (start > mapping->bits)
+		if (start > PAGE_SIZE)
 			continue;
 
 		bitmap_set(mapping->bitmaps[i], start, count);
@@ -1110,9 +1110,9 @@ static inline dma_addr_t __alloc_iova(struct dma_iommu_mapping *mapping,
 		}
 
 		start = bitmap_find_next_zero_area(mapping->bitmaps[i],
-				mapping->bits, 0, count, align);
+				PAGE_SIZE, 0, count, align);
 
-		if (start > mapping->bits) {
+		if (start > PAGE_SIZE) {
 			spin_unlock_irqrestore(&mapping->lock, flags);
 			return DMA_ERROR_CODE;
 		}
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/