Re: [PATCH v2] ioatdma: fix overflow of u16 in ring_reshape

[Dan Williams]

On Wed, Aug 5, 2015 at 7:55 AM, Allen Hubbe <Allen.Hubbe@xxxxxxx> wrote:
> If the allocation order is 16, then the u16 index will overflow and wrap
> to zero instead of being equal or greater than 1 << 16.  The loop
> condition will always be true, and the loop will run until all the
> memory resources are depleted.
>
> Change the type of index 'i' to u32, so that it is large enough to store
> a value equal or greater than 1 << 16.
>
> Signed-off-by: Allen Hubbe <Allen.Hubbe@xxxxxxx>
> ---
>
> Version Two: rebased the fix on top of Dave Jiang's work.
>

Hmm, I think we should instead limit the max order to 15 instead
because there are other usages of u16 throughout the driver.  In fact
I thought that was already enforced, but seems I'm mistaken.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/