The patch titled dma-mapping: fix off-by-one error in dma_capable() has been added to the -mm tree. Its filename is dma-mapping-fix-off-by-one-error-in-dma_capable.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: dma-mapping: fix off-by-one error in dma_capable() From: "Jan Beulich" <JBeulich@xxxxxxxxxx> dma_mask is, when interpreted as address, the last valid byte, and hence comparison msut also be done using the last valid of the buffer in question. Also fix the open-coded instances in lib/swiotlb.c. Signed-off-by: Jan Beulich <jbeulich@xxxxxxxxxx> Cc: FUJITA Tomonori <fujita.tomonori@xxxxxxxxxxxxx> Cc: Becky Bruce <beckyb@xxxxxxxxxxxxxxxxxxx> Cc: "Luck, Tony" <tony.luck@xxxxxxxxx> Cc: Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx> Cc: Ingo Molnar <mingo@xxxxxxx> Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx> Cc: "H. Peter Anvin" <hpa@xxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- diff -puN arch/ia64/include/asm/dma-mapping.h~dma-mapping-fix-off-by-one-error-in-dma_capable arch/ia64/include/asm/dma-mapping.h --- a/arch/ia64/include/asm/dma-mapping.h~dma-mapping-fix-off-by-one-error-in-dma_capable +++ a/arch/ia64/include/asm/dma-mapping.h @@ -73,7 +73,7 @@ static inline bool dma_capable(struct de if (!dev->dma_mask) return 0; - return addr + size <= *dev->dma_mask; + return addr + size - 1 <= *dev->dma_mask; } static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr) diff -puN arch/powerpc/include/asm/dma-mapping.h~dma-mapping-fix-off-by-one-error-in-dma_capable arch/powerpc/include/asm/dma-mapping.h --- a/arch/powerpc/include/asm/dma-mapping.h~dma-mapping-fix-off-by-one-error-in-dma_capable +++ a/arch/powerpc/include/asm/dma-mapping.h @@ -197,7 +197,7 @@ static inline bool dma_capable(struct de if (!dev->dma_mask) return 0; - return addr + size <= *dev->dma_mask; + return addr + size - 1 <= *dev->dma_mask; } static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr) diff -puN arch/x86/include/asm/dma-mapping.h~dma-mapping-fix-off-by-one-error-in-dma_capable arch/x86/include/asm/dma-mapping.h --- a/arch/x86/include/asm/dma-mapping.h~dma-mapping-fix-off-by-one-error-in-dma_capable +++ a/arch/x86/include/asm/dma-mapping.h @@ -60,7 +60,7 @@ static inline bool dma_capable(struct de if (!dev->dma_mask) return 0; - return addr + size <= *dev->dma_mask; + return addr + size - 1 <= *dev->dma_mask; } static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr) diff -puN lib/swiotlb.c~dma-mapping-fix-off-by-one-error-in-dma_capable lib/swiotlb.c --- a/lib/swiotlb.c~dma-mapping-fix-off-by-one-error-in-dma_capable +++ a/lib/swiotlb.c @@ -517,7 +517,7 @@ swiotlb_alloc_coherent(struct device *hw dma_mask = hwdev->coherent_dma_mask; ret = (void *)__get_free_pages(flags, order); - if (ret && swiotlb_virt_to_bus(hwdev, ret) + size > dma_mask) { + if (ret && swiotlb_virt_to_bus(hwdev, ret) + size - 1 > dma_mask) { /* * The allocated memory isn't reachable by the device. */ @@ -539,7 +539,7 @@ swiotlb_alloc_coherent(struct device *hw dev_addr = swiotlb_virt_to_bus(hwdev, ret); /* Confirm address can be DMA'd by device */ - if (dev_addr + size > dma_mask) { + if (dev_addr + size - 1 > dma_mask) { printk("hwdev DMA mask = 0x%016Lx, dev_addr = 0x%016Lx\n", (unsigned long long)dma_mask, (unsigned long long)dev_addr); _ Patches currently in -mm which might be from JBeulich@xxxxxxxxxx are origin.patch linux-next.patch kbuild-generate-modulesbuiltin.patch kbuild-rebuild-fix-for-makefilemodbuiltin.patch drm-make-sure-page-protections-are-updated-after-changing-vm_flags.patch vmalloc-adjust-gfp-mask-passed-on-nested-vmalloc-invocation.patch dma-mapping-fix-off-by-one-error-in-dma_capable.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html