do_mmap_pgoff issue...

do_mmap_pgoff issue...

[Gerhard Jaeger]

Hi list,

while trying to mmap some flash area on my mpc8541 CDS board, 
I noticed that the overflow case is probably not correctly handled 
within function do_mmap_pgoff in linux/mm/mmap.c

The facts:
- mmap the last page @ 0xFFFFF000, len 4K
- result: mmap says EOVERFLOW...
- the function that failed was do_mmap_pgoff()

Here's the pice of code

/* offset overflow? */
if ((pgoff + (len >> PAGE_SHIFT)) < pgoff)
    return -EOVERFLOW;

It's quite clear why it fails in my case:
pgoff + (len >> PAGE_SHIFT) will be 0

I fixed that by inserting the following, to handle that special case:

if ((pgoff + (len >> PAGE_SHIFT)) < pgoff) {
    if ((pgoff + (len >> PAGE_SHIFT)) != 0 )
        return -EOVERFLOW;
}

My question is - is that behaviour a bug or a feature? In fact it's
an off-by-one issue, but I could not believe, that nobody else ever
had problems with that.

TIA for enlighten me
Gerhard

-- 
Gerhard Jaeger <gjaeger@sysgo.com>            
SYSGO AG                      Embedded and Real-Time Software
www.sysgo.com | www.elinos.com | www.pikeos.com | www.osek.de 

Re: do_mmap_pgoff issue...

[Paul Mackerras]

Gerhard Jaeger writes:

> The facts:
> - mmap the last page @ 0xFFFFF000, len 4K
> - result: mmap says EOVERFLOW...
> - the function that failed was do_mmap_pgoff()
> 
> Here's the pice of code
> 
> /* offset overflow? */
> if ((pgoff + (len >> PAGE_SHIFT)) < pgoff)
>     return -EOVERFLOW;
> 
> It's quite clear why it fails in my case:
> pgoff + (len >> PAGE_SHIFT) will be 0

No, pgoff will be 0xfffff, len will be 1, the sum is 0x100000.  You
need to look elsewhere for the problem.

Paul.