dma-coherent: fix integer overflow in the reserved-memory dma allocation
authorKevin Grandemange <kevin.grandemange@allegrodvt.com>
Thu, 12 Mar 2020 15:41:45 +0000 (15:41 +0000)
committerChristoph Hellwig <hch@lst.de>
Mon, 16 Mar 2020 09:43:02 +0000 (10:43 +0100)
commit286c21de32b904131f8cf6a36ce40b8b0c9c5da3
treef49e515ea7dae21ce3270d3fa1160dcc5dd9ae5a
parent11a48a5a18c63fd7621bb050228cebf13566e4d8
dma-coherent: fix integer overflow in the reserved-memory dma allocation

pageno is an int and the PAGE_SHIFT shift is done on an int,
overflowing if the memory is bigger than 2G

This can be reproduced using for example a reserved-memory of 4G

reserved-memory {
    #address-cells = <2>;
    #size-cells = <2>;
    ranges;

    reserved_dma: buffer@0 {
        compatible = "shared-dma-pool";
        no-map;
        reg = <0x5 0x00000000 0x1 0x0>;
        };
};

Signed-off-by: Kevin Grandemange <kevin.grandemange@allegrodvt.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
kernel/dma/coherent.c