diff options
| author | Jan Beulich <jbeulich@novell.com> | 2008-03-13 09:13:30 +0000 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-03-13 13:15:52 -0700 |
| commit | b15a3891c916f32a29832886a053a48be2741d4d (patch) | |
| tree | 59971b1f3b1961b7c13a170b1a3617431db03ac5 | |
| parent | 96e31022a1b6e7cb173cbb3dce1fde7ba548860a (diff) | |
| download | linux-b15a3891c916f32a29832886a053a48be2741d4d.tar.bz2 | |
avoid endless loops in lib/swiotlb.c
Commit 681cc5cd3efbeafca6386114070e0bfb5012e249 ("iommu sg merging:
swiotlb: respect the segment boundary limits") introduced two
possibilities for entering an endless loop in lib/swiotlb.c:
- if max_slots is zero (possible if mask is ~0UL)
- if the number of slots requested fits into a swiotlb segment, but is
too large for the part of a segment which remains after considering
offset_slots
This fixes them
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Cc: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | lib/swiotlb.c | 30 |
1 files changed, 16 insertions, 14 deletions
diff --git a/lib/swiotlb.c b/lib/swiotlb.c index 4bb5a11e18a2..025922807e6e 100644 --- a/lib/swiotlb.c +++ b/lib/swiotlb.c @@ -310,7 +310,9 @@ map_single(struct device *hwdev, char *buffer, size_t size, int dir) start_dma_addr = virt_to_bus(io_tlb_start) & mask; offset_slots = ALIGN(start_dma_addr, 1 << IO_TLB_SHIFT) >> IO_TLB_SHIFT; - max_slots = ALIGN(mask + 1, 1 << IO_TLB_SHIFT) >> IO_TLB_SHIFT; + max_slots = mask + 1 + ? ALIGN(mask + 1, 1 << IO_TLB_SHIFT) >> IO_TLB_SHIFT + : 1UL << (BITS_PER_LONG - IO_TLB_SHIFT); /* * For mappings greater than a page, we limit the stride (and @@ -333,16 +335,18 @@ map_single(struct device *hwdev, char *buffer, size_t size, int dir) index = ALIGN(io_tlb_index, stride); if (index >= io_tlb_nslabs) index = 0; - - while (is_span_boundary(index, nslots, offset_slots, - max_slots)) { - index += stride; - if (index >= io_tlb_nslabs) - index = 0; - } wrap = index; do { + while (is_span_boundary(index, nslots, offset_slots, + max_slots)) { + index += stride; + if (index >= io_tlb_nslabs) + index = 0; + if (index == wrap) + goto not_found; + } + /* * If we find a slot that indicates we have 'nslots' * number of contiguous buffers, we allocate the @@ -367,14 +371,12 @@ map_single(struct device *hwdev, char *buffer, size_t size, int dir) goto found; } - do { - index += stride; - if (index >= io_tlb_nslabs) - index = 0; - } while (is_span_boundary(index, nslots, offset_slots, - max_slots)); + index += stride; + if (index >= io_tlb_nslabs) + index = 0; } while (index != wrap); + not_found: spin_unlock_irqrestore(&io_tlb_lock, flags); return NULL; } |