I've noticed that the calculations for seg_size and nr_segs in
__dma_sync_page_highmem() (arch/ppc/kernel/dma-mapping.c) are wrong.  The
incorrect calculations can result in either an oops or a panic when running
fsck depending on the size of the partition.

The problem with the seg_size calculation is that it can result in a
negative number if size is offset > size.  The problem with the nr_segs
caculation is returns the wrong number of segments, e.g.  it returns 1 when
size is 200 and offset is 4095, when it should return 2 or more.

Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Paolo Galtieri 2005-10-11 08:29:07 -07:00 коммит произвёл Linus Torvalds
Родитель 1bef400329
Коммит a0c111c631
1 изменённых файлов: 2 добавлений и 2 удалений

Просмотреть файл

@ -401,10 +401,10 @@ EXPORT_SYMBOL(__dma_sync);
static inline void __dma_sync_page_highmem(struct page *page,
unsigned long offset, size_t size, int direction)
{
size_t seg_size = min((size_t)PAGE_SIZE, size) - offset;
size_t seg_size = min((size_t)(PAGE_SIZE - offset), size);
size_t cur_size = seg_size;
unsigned long flags, start, seg_offset = offset;
int nr_segs = PAGE_ALIGN(size + (PAGE_SIZE - offset))/PAGE_SIZE;
int nr_segs = 1 + ((size - seg_size) + PAGE_SIZE - 1)/PAGE_SIZE;
int seg_nr = 0;
local_irq_save(flags);