From patchwork Tue Dec 18 18:48:40 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Jones X-Patchwork-Id: 10736205 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 103FF1399 for ; Tue, 18 Dec 2018 18:48:52 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 00FF62A10B for ; Tue, 18 Dec 2018 18:48:52 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E98102A248; Tue, 18 Dec 2018 18:48:51 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A2EB52A10B for ; Tue, 18 Dec 2018 18:48:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726630AbeLRSsv (ORCPT ); Tue, 18 Dec 2018 13:48:51 -0500 Received: from mx1.redhat.com ([209.132.183.28]:50188 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726451AbeLRSsu (ORCPT ); Tue, 18 Dec 2018 13:48:50 -0500 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 347F412BF7; Tue, 18 Dec 2018 18:48:50 +0000 (UTC) Received: from kamzik.brq.redhat.com (unknown [10.43.2.160]) by smtp.corp.redhat.com (Postfix) with ESMTP id 1BA505D70A; Tue, 18 Dec 2018 18:48:47 +0000 (UTC) From: Andrew Jones To: iommu@lists.linux-foundation.org, linux-acpi@vger.kernel.org Cc: joro@8bytes.org, lorenzo.pieralisi@arm.com, hanjun.guo@linaro.org, sudeep.holla@arm.com, robin.murphy@arm.com, eric.auger@redhat.com Subject: [PATCH 1/2] ACPI/IORT: Handle potential overflow in iort_dma_setup Date: Tue, 18 Dec 2018 19:48:40 +0100 Message-Id: <20181218184841.20034-2-drjones@redhat.com> In-Reply-To: <20181218184841.20034-1-drjones@redhat.com> References: <20181218184841.20034-1-drjones@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Tue, 18 Dec 2018 18:48:50 +0000 (UTC) Sender: linux-acpi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-acpi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The sum of dmaaddr and size may overflow, particularly considering there are cases where size will be U64_MAX. Signed-off-by: Andrew Jones --- drivers/acpi/arm64/iort.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c index 70f4e80b9246..a0f4c157ba5e 100644 --- a/drivers/acpi/arm64/iort.c +++ b/drivers/acpi/arm64/iort.c @@ -1002,7 +1002,12 @@ void iort_dma_setup(struct device *dev, u64 *dma_addr, u64 *dma_size) } if (!ret) { - msb = fls64(dmaaddr + size - 1); + u64 dmaaddr_max = dmaaddr + size - 1; + if (dmaaddr_max >= dmaaddr) + msb = fls64(dmaaddr_max); + else + msb = 64; + /* * Round-up to the power-of-two mask or set * the mask to the whole 64-bit address space