aboutsummaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorJoonyoung Shim <jy0922.shim@samsung.com>2013-09-11 14:21:43 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-12-11 22:36:28 -0800
commit2e8cb3339b9e52c4d8dcaca913412ebab5dae271 (patch)
tree6f508219dcb7e6fcdbdcd1508254cb3b73fa24c3 /include
parenta879b58d2f464a4a18087b48f7fbb8e23350cb49 (diff)
lib/genalloc.c: fix overflow of ending address of memory chunk
commit 674470d97958a0ec72f72caf7f6451da40159cc7 upstream. In struct gen_pool_chunk, end_addr means the end address of memory chunk (inclusive), but in the implementation it is treated as address + size of memory chunk (exclusive), so it points to the address plus one instead of correct ending address. The ending address of memory chunk plus one will cause overflow on the memory chunk including the last address of memory map, e.g. when starting address is 0xFFF00000 and size is 0x100000 on 32bit machine, ending address will be 0x100000000. Use correct ending address like starting address + size - 1. [akpm@linux-foundation.org: add comment to struct gen_pool_chunk:end_addr] Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include')
-rw-r--r--include/linux/genalloc.h4
1 files changed, 2 insertions, 2 deletions
diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h
index 661d374aeb2..f8d41cb1cbe 100644
--- a/include/linux/genalloc.h
+++ b/include/linux/genalloc.h
@@ -66,8 +66,8 @@ struct gen_pool_chunk {
struct list_head next_chunk; /* next chunk in pool */
atomic_t avail;
phys_addr_t phys_addr; /* physical starting address of memory chunk */
- unsigned long start_addr; /* starting address of memory chunk */
- unsigned long end_addr; /* ending address of memory chunk */
+ unsigned long start_addr; /* start address of memory chunk */
+ unsigned long end_addr; /* end address of memory chunk (inclusive) */
unsigned long bits[0]; /* bitmap for allocating memory chunk */
};