[PATCH v3 0/2] ioatdma: fix overflow of u16 variables

[PATCH v3 0/2] ioatdma: fix overflow of u16 variables

[Allen Hubbe]

Fix overflow of u16 variables in ioatdma.

Allen Hubbe (2):
  ioatdma: fix overflow of u16 in ring_reshape
  ioatdma: fix overflow of u16 in freeing resources

 drivers/dma/ioat/dma.c  | 2 +-
 drivers/dma/ioat/init.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

-- 
2.5.0.rc1

[PATCH v3 1/2] ioatdma: fix overflow of u16 in ring_reshape

[Allen Hubbe]

If the allocation order is 16, then the u16 index will overflow and wrap
to zero instead of being equal or greater than 1 << 16.  The loop
condition will always be true, and the loop will run until all the
memory resources are depleted.

Change the type of index 'i' to u32, so that it is large enough to store
a value equal or greater than 1 << 16.

Signed-off-by: Allen Hubbe <Allen.Hubbe@emc.com>
---
 drivers/dma/ioat/dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index a5630966834e..7435585dbbd6 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -372,7 +372,7 @@ static bool reshape_ring(struct ioatdma_chan *ioat_chan, int order)
 	const u16 active = ioat_ring_active(ioat_chan);
 	const u32 new_size = 1 << order;
 	struct ioat_ring_ent **ring;
-	u16 i;
+	u32 i;
 
 	if (order > ioat_get_max_alloc_order())
 		return false;
-- 
2.5.0.rc1

[PATCH v3 2/2] ioatdma: fix overflow of u16 in freeing resources

[Allen Hubbe]

If the allocation order is 16, then the u16 count will overflow and wrap
to zero when assigned the value 1 << 16.

Change the type of 'total_descs' to int, so that it is large enough to
store a value equal or greater than 1 << 16.

Signed-off-by: Allen Hubbe <Allen.Hubbe@emc.com>
---
 drivers/dma/ioat/init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
index 2c6846a12688..f078af445d5c 100644
--- a/drivers/dma/ioat/init.c
+++ b/drivers/dma/ioat/init.c
@@ -603,7 +603,7 @@ static void ioat_free_chan_resources(struct dma_chan *c)
 	struct ioatdma_chan *ioat_chan = to_ioat_chan(c);
 	struct ioatdma_device *ioat_dma = ioat_chan->ioat_dma;
 	struct ioat_ring_ent *desc;
-	const u16 total_descs = 1 << ioat_chan->alloc_order;
+	const int total_descs = 1 << ioat_chan->alloc_order;
 	int descs;
 	int i;
 
-- 
2.5.0.rc1

Re: [PATCH v3 0/2] ioatdma: fix overflow of u16 variables

[Vinod Koul]

On Wed, Aug 05, 2015 at 12:40:58PM -0400, Allen Hubbe wrote:
> Fix overflow of u16 variables in ioatdma.
This fails for me, was it generated on top of Dave's series

-- 
~Vinod

RE: [PATCH v3 0/2] ioatdma: fix overflow of u16 variables

[Allen Hubbe]

From: Vinod Koul
> This fails for me, was it generated on top of Dave's series

Would you prefer this based on Linus' current rc6 instead of Dave's?  I will do that, and send v5.

This was generated on top of Dave's, as of v2 of this series.  We figured it would be easier to base the smaller patch on Dave's, considering the relative number and complexity of the patches, and also considering that his series was already Ack'd.  If you accept v5, then Dave will have some rework.