2006-11-01 05:40:00

by Chris Wright

[permalink] [raw]
Subject: [PATCH 24/61] SPARC64: Fix memory corruption in pci_4u_free_consistent().

-stable review patch. If anyone has any objections, please let us know.
------------------

From: David Miller <[email protected]>

The second argument to free_npages() was being incorrectly
calculated, which would thus access far past the end of the
arena->map[] bitmap.

Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Chris Wright <[email protected]>

---
arch/sparc64/kernel/pci_iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.18.1.orig/arch/sparc64/kernel/pci_iommu.c
+++ linux-2.6.18.1/arch/sparc64/kernel/pci_iommu.c
@@ -281,7 +281,7 @@ static void pci_4u_free_consistent(struc

spin_lock_irqsave(&iommu->lock, flags);

- free_npages(iommu, dvma, npages);
+ free_npages(iommu, dvma - iommu->page_table_map_base, npages);

spin_unlock_irqrestore(&iommu->lock, flags);


--