Hi Chris, Ok, will change that locally here. Would that change also apply to the equivalent test in dma_alloc_coherent() ? -----Original Message----- From: czankel [mailto:chris@xxxxxxxxxx] Sent: 23 July 2014 17:17 To: Max Filippov; linux-xtensa@xxxxxxxxxxxxxxxx; Alan Douglas Cc: Marc Gauthier; stable@xxxxxxxxxxxxxxx Subject: Re: [PATCH] xtensa: fix address check in dma_free_coherent Hi Allan, Could catch! Could you do the following minor change (see below)? On 7/23/14, 3:19 AM, Max Filippov wrote: > From: Alan Douglas <adouglas@xxxxxxxxxxx> > > Virtual address is translated to the XCHAL_KSEG_CACHED region in the > dma_free_coherent, but is checked to be in the 0...XCHAL_KSEG_SIZE > range. > > Cc: stable@xxxxxxxxxxxxxxx > Signed-off-by: Alan Douglas <adouglas@xxxxxxxxxxx> > Signed-off-by: Max Filippov <jcmvbkbc@xxxxxxxxx> > --- > arch/xtensa/kernel/pci-dma.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/arch/xtensa/kernel/pci-dma.c b/arch/xtensa/kernel/pci-dma.c > index 2d9cc6d..ccf400f 100644 > --- a/arch/xtensa/kernel/pci-dma.c > +++ b/arch/xtensa/kernel/pci-dma.c > @@ -68,9 +68,11 @@ EXPORT_SYMBOL(dma_alloc_coherent); > void dma_free_coherent(struct device *hwdev, size_t size, > void *vaddr, dma_addr_t dma_handle) > { > - long addr=(long)vaddr+XCHAL_KSEG_CACHED_VADDR-XCHAL_KSEG_BYPASS_VADDR; > + unsigned long addr = (unsigned long)vaddr + > + XCHAL_KSEG_CACHED_VADDR - XCHAL_KSEG_BYPASS_VADDR; > > - if (addr < 0 || addr >= XCHAL_KSEG_SIZE) > + if (addr < XCHAL_KSEG_CACHED_VADDR || > + addr >= XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE) addr > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1) (In case that segment is at the top of the memory, the check would be addr >= 0) Thanks, -Chris -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html