From 5b5e59f8d576dc2d3d54289448558db3172ceec9 Mon Sep 17 00:00:00 2001 From: Jeremy Higdon Date: Sat, 28 Aug 2004 11:02:49 -0400 Subject: [PATCH] [PATCH] Fix DMA boundary overflow bug We seem to have found an overflow problem in libata-core.c. We were trying to DMA to the address range 0xffff8000-0xffffbfff. In the original version of the code, given that address and count (0xffff8000 and 0x4000), the variable "boundary" would be set to 0, causing len to be set to 0x8000 (which is greater than sg_len). Then at the bottom of the loop, sg_len would be set to 0xffffc000 (0x4000 - 0x8000), which would then cause the loop never to terminate (until much of memory was scribbled over or the kernel died). The code below should be functionally identical, but not be subject to the same overflow problem (boundary needs to be a u33). Signed-off-by: jeremy@sgi.com ===== drivers/scsi/libata-core.c 1.94 vs edited ===== --- drivers/scsi/libata-core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c index e9891d77e721a..52cfe3e97cfc6 100644 --- a/drivers/scsi/libata-core.c +++ b/drivers/scsi/libata-core.c @@ -1836,7 +1836,7 @@ static void ata_fill_sg(struct ata_queued_cmd *qc) idx = 0; for (nelem = qc->n_elem; nelem; nelem--,sg++) { - u32 addr, boundary; + u32 addr, offset; u32 sg_len, len; /* determine if physical DMA addr spans 64K boundary. @@ -1847,10 +1847,10 @@ static void ata_fill_sg(struct ata_queued_cmd *qc) sg_len = sg_dma_len(sg); while (sg_len) { - boundary = (addr & ~0xffff) + (0xffff + 1); + offset = addr & 0xffff; len = sg_len; - if ((addr + sg_len) > boundary) - len = boundary - addr; + if ((offset + sg_len) > 0x10000) + len = 0x10000 - offset; ap->prd[idx].addr = cpu_to_le32(addr); ap->prd[idx].flags_len = cpu_to_le32(len & 0xffff); -- 2.53.0