dma-coherent: fix integer overflow in the reserved-memory dma allocation
authorKevin Grandemange <kevin.grandemange@allegrodvt.com>
Thu, 12 Mar 2020 15:41:45 +0000 (15:41 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 23 Apr 2020 08:36:30 +0000 (10:36 +0200)
commit56aaa0e8c92a5262e5bde7057972080e8b2f17d6
treef7ab644d8f499596545e0dac3061daa1e95c623d
parent960bf4e436ca0eeb72a2b838b3453f823563a0f3
dma-coherent: fix integer overflow in the reserved-memory dma allocation

[ Upstream commit 286c21de32b904131f8cf6a36ce40b8b0c9c5da3 ]

pageno is an int and the PAGE_SHIFT shift is done on an int,
overflowing if the memory is bigger than 2G

This can be reproduced using for example a reserved-memory of 4G

reserved-memory {
    #address-cells = <2>;
    #size-cells = <2>;
    ranges;

    reserved_dma: buffer@0 {
        compatible = "shared-dma-pool";
        no-map;
        reg = <0x5 0x00000000 0x1 0x0>;
        };
};

Signed-off-by: Kevin Grandemange <kevin.grandemange@allegrodvt.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
kernel/dma/coherent.c