Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 21b764e0 authored by Dave Jiang's avatar Dave Jiang Committed by Dan Williams
Browse files

ioat: ring size variables need to be 32bit to avoid overflow 



The alloc order can be up to 16 and 1 << 16 will over flow the 16bit
integer. Change the appropriate variables to 16bit to avoid overflow.

Reported-by: default avatarJim Harris <james.r.harris@intel.com>
Signed-off-by: default avatarDave Jiang <dave.jiang@intel.com>
Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
parent 3d9ea9e3

drivers/dma/ioat/dma_v2.c

+2 −2
Original line number Diff line number Diff line
@@ -575,9 +575,9 @@ bool reshape_ring(struct ioat2_dma_chan *ioat, int order) 
	 */

	struct ioat_chan_common *chan = &ioat->base;

	struct dma_chan *c = &chan->common;

	const u16 curr_size = ioat2_ring_size(ioat);

	const u32 curr_size = ioat2_ring_size(ioat);

	const u16 active = ioat2_ring_active(ioat);

	const u16 new_size = 1 << order;

	const u32 new_size = 1 << order;

	struct ioat_ring_ent **ring;

	u16 i;

drivers/dma/ioat/dma_v2.h

+2 −2
Original line number Diff line number Diff line
@@ -74,7 +74,7 @@ static inline struct ioat2_dma_chan *to_ioat2_chan(struct dma_chan *c) 
	return container_of(chan, struct ioat2_dma_chan, base);

}



static inline u16 ioat2_ring_size(struct ioat2_dma_chan *ioat)

static inline u32 ioat2_ring_size(struct ioat2_dma_chan *ioat)

{

	return 1 << ioat->alloc_order;

}
@@ -91,7 +91,7 @@ static inline u16 ioat2_ring_pending(struct ioat2_dma_chan *ioat) 
	return CIRC_CNT(ioat->head, ioat->issued, ioat2_ring_size(ioat));

}



static inline u16 ioat2_ring_space(struct ioat2_dma_chan *ioat)

static inline u32 ioat2_ring_space(struct ioat2_dma_chan *ioat)

{

	return ioat2_ring_size(ioat) - ioat2_ring_active(ioat);

}