• Russell King - ARM Linux's avatar
    ARM: PL08x: ensure pl08x_pre_boundary() works for any value of addr · b61be8d7
    Russell King - ARM Linux authored
    pl08x_pre_boundary() was unsafe with addresses towards the top of
    memory space:
    
    	boundary = ((addr >> PL08X_BOUNDARY_SHIFT) + 1)
    			<< PL08X_BOUNDARY_SHIFT;
    
    This can overflow a 32-bit number, producing zero.  When it does:
    
    	if (boundary < addr + len)
    		return boundary - addr;
    	else
    		return len;
    
    results in (boundary - addr) returning either a large positive value.
    Also if addr + len overflows, this calculation also fails.
    
    We can fix this trivially as the only thing we're actually interested
    in is the value of the least significant PL08X_BOUNDARY_SHIFT bits:
    
    	boundary_len = PL08X_BOUNDARY_SIZE -
    		(addr & (PL08X_BOUNDARY_SIZE - 1));
    
    gives us the number of bytes before 'addr' becomes a multiple of
    PL08X_BOUNDARY_SIZE.  We can then just take the min() of the two
    calculated lengths.
    Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
    Acked-by: default avatarLinus Walleij <linus.walleij@stericsson.com>
    Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
    b61be8d7
amba-pl08x.c 53 KB