Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752720AbbHEUDz (ORCPT ); Wed, 5 Aug 2015 16:03:55 -0400 Received: from mail-wi0-f169.google.com ([209.85.212.169]:35600 "EHLO mail-wi0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751867AbbHEUDx (ORCPT ); Wed, 5 Aug 2015 16:03:53 -0400 MIME-Version: 1.0 In-Reply-To: <7fb27a69349e6a5fc6006752104de90c64cb27d2.1438781843.git.Allen.Hubbe@emc.com> References: <7fb27a69349e6a5fc6006752104de90c64cb27d2.1438781843.git.Allen.Hubbe@emc.com> Date: Wed, 5 Aug 2015 13:03:52 -0700 Message-ID: Subject: Re: [PATCH v2] ioatdma: fix overflow of u16 in ring_reshape From: Dan Williams To: Allen Hubbe Cc: Dave Jiang , "dmaengine@vger.kernel.org" , "linux-kernel@vger.kernel.org" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1001 Lines: 23 On Wed, Aug 5, 2015 at 7:55 AM, Allen Hubbe wrote: > If the allocation order is 16, then the u16 index will overflow and wrap > to zero instead of being equal or greater than 1 << 16. The loop > condition will always be true, and the loop will run until all the > memory resources are depleted. > > Change the type of index 'i' to u32, so that it is large enough to store > a value equal or greater than 1 << 16. > > Signed-off-by: Allen Hubbe > --- > > Version Two: rebased the fix on top of Dave Jiang's work. > Hmm, I think we should instead limit the max order to 15 instead because there are other usages of u16 throughout the driver. In fact I thought that was already enforced, but seems I'm mistaken. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/