Commit 676bd991 authored by Robin Murphy's avatar Robin Murphy Committed by Linus Torvalds
Browse files

dmapool: fix overflow condition in pool_find_page()

If a DMA pool lies at the very top of the dma_addr_t range (as may
happen with an IOMMU involved), the calculated end address of the pool
wraps around to zero, and page lookup always fails.

Tweak the relevant calculation to be overflow-proof.

Signed-off-by: Robin Murphy's avatarRobin Murphy <>
Cc: Arnd Bergmann <>
Cc: Marek Szyprowski <>
Cc: Sumit Semwal <>
Cc: Sakari Ailus <>
Cc: Russell King <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent 44241628
......@@ -394,7 +394,7 @@ static struct dma_page *pool_find_page(struct dma_pool *pool, dma_addr_t dma)
list_for_each_entry(page, &pool->page_list, page_list) {
if (dma < page->dma)
if (dma < (page->dma + pool->allocation))
if ((dma - page->dma) < pool->allocation)
return page;
return NULL;
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment