dmapool: fix overflow condition in pool_find_page()

If a DMA pool lies at the very top of the dma_addr_t range (as may
happen with an IOMMU involved), the calculated end address of the pool
wraps around to zero, and page lookup always fails.

Tweak the relevant calculation to be overflow-proof.

Signed-off-by: Robin Murphy <[email protected]>
Cc: Arnd Bergmann <[email protected]>
Cc: Marek Szyprowski <[email protected]>
Cc: Sumit Semwal <[email protected]>
Cc: Sakari Ailus <[email protected]>
Cc: Russell King <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

diff --git a/mm/dmapool.c b/mm/dmapool.c
index 71a8998cd03a6b8b0d2dbfe36a24ce70766047e8..312a716fa14c2ef0d2780832bc378c05a3d08d16 100644 (file)
--- a/mm/dmapool.c
+++ b/mm/dmapool.c
@@ -394,7 +394,7 @@ static struct dma_page *pool_find_page(struct dma_pool *pool, dma_addr_t dma)
        list_for_each_entry(page, &pool->page_list, page_list) {
                if (dma < page->dma)
                        continue;
-               if (dma < (page->dma + pool->allocation))
+               if ((dma - page->dma) < pool->allocation)
                        return page;
        }
        return NULL;