From patchwork Mon Sep 15 20:43:35 2008 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roland Dreier X-Patchwork-Id: 281 Return-Path: X-Original-To: patchwork@ozlabs.org Delivered-To: patchwork@ozlabs.org Received: from ozlabs.org (localhost [127.0.0.1]) by ozlabs.org (Postfix) with ESMTP id EA06CDE66A for ; Tue, 16 Sep 2008 06:43:58 +1000 (EST) X-Original-To: linuxppc-dev@ozlabs.org Delivered-To: linuxppc-dev@ozlabs.org Received: from sj-iport-3.cisco.com (sj-iport-3.cisco.com [171.71.176.72]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client CN "sj-iport-3.cisco.com", Issuer "Cisco SSCA" (not verified)) by ozlabs.org (Postfix) with ESMTPS id 00CD3DE304 for ; Tue, 16 Sep 2008 06:43:39 +1000 (EST) Received: from sj-dkim-2.cisco.com ([171.71.179.186]) by sj-iport-3.cisco.com with ESMTP; 15 Sep 2008 20:43:36 +0000 Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id m8FKhaaw020983; Mon, 15 Sep 2008 13:43:36 -0700 Received: from xbh-sjc-211.amer.cisco.com (xbh-sjc-211.cisco.com [171.70.151.144]) by sj-core-5.cisco.com (8.13.8/8.13.8) with ESMTP id m8FKha5F026997; Mon, 15 Sep 2008 20:43:36 GMT Received: from xfe-sjc-212.amer.cisco.com ([171.70.151.187]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 15 Sep 2008 13:43:36 -0700 Received: from roland-conroe ([10.33.42.9]) by xfe-sjc-212.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 15 Sep 2008 13:43:35 -0700 Received: by roland-conroe (Postfix, from userid 33217) id BAB061B64DA; Mon, 15 Sep 2008 13:43:35 -0700 (PDT) From: Roland Dreier To: Paul Mackerras Subject: [PATCH] powerpc: Avoid integer overflow in page_is_ram() References: <18638.50702.962371.862911@cargo.ozlabs.ibm.com> X-Message-Flag: Warning: May contain useful information Date: Mon, 15 Sep 2008 13:43:35 -0700 In-Reply-To: <18638.50702.962371.862911@cargo.ozlabs.ibm.com> (Paul Mackerras's message of "Mon, 15 Sep 2008 13:31:10 -0700") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.0.60 (gnu/linux) MIME-Version: 1.0 X-OriginalArrivalTime: 15 Sep 2008 20:43:35.0889 (UTC) FILETIME=[B9935C10:01C91773] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1823; t=1221511416; x=1222375416; c=relaxed/simple; s=sjdkim2002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdreier@cisco.com; z=From:=20Roland=20Dreier=20 |Subject:=20[PATCH]=20powerpc=3A=20Avoid=20integer=20overfl ow=20in=20page_is_ram() |Sender:=20; bh=bq+G/nGjSqguYyakt09h2WWTWQoj3E0vVA5XsqOwo6k=; b=08YsSIzL3MRqv9DOV5Gp1EUucW15FjdGBSyuqiyz7qxm6W081+YRP947DC SjDs5b1ZEiqCy1ul0ZCNeffWL3ZgQdPP57o3ggMLqTtMJwZhsratTXa3+AEk 8BiEmtDzai; Authentication-Results: sj-dkim-2; header.From=rdreier@cisco.com; dkim=pass ( sig from cisco.com/sjdkim2002 verified; ); Cc: linuxppc-dev@ozlabs.org X-BeenThere: linuxppc-dev@ozlabs.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linuxppc-dev-bounces+patchwork=ozlabs.org@ozlabs.org Errors-To: linuxppc-dev-bounces+patchwork=ozlabs.org@ozlabs.org Commit 8b150478 ("ppc: make phys_mem_access_prot() work with pfns instead of addresses") fixed page_is_ram() in arch/ppc to avoid overflow for addresses above 4G on 32-bit kernels. However arch/powerpc's page_is_ram() is missing the same fix -- it computes a physical address by doing pfn << PAGE_SHIFT, which overflows if pfn corresponds to a page above 4G. In particular this causes pages above 4G to be mapped with the wrong caching attribute; for example many ppc440-based SoCs have PCI space above 4G, and mmap()ing MMIO space may end up with a mapping that has caching enabled. Fix this by working with the pfn and avoiding the conversion to physical address that causes the overflow. This patch compares the pfn to max_pfn, which is a semantic change from the old code -- that code compared the physical address to high_memory, which corresponds to max_low_pfn. However, I think that was is another bug, since highmem pages are still RAM. Reported-by: vb Signed-off-by: Roland Dreier Acked-by: Benjamin Herrenschmidt diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c index 1c93c25..98d7bf9 100644 --- a/arch/powerpc/mm/mem.c +++ b/arch/powerpc/mm/mem.c @@ -75,11 +75,10 @@ static inline pte_t *virt_to_kpte(unsigned long vaddr) int page_is_ram(unsigned long pfn) { - unsigned long paddr = (pfn << PAGE_SHIFT); - #ifndef CONFIG_PPC64 /* XXX for now */ - return paddr < __pa(high_memory); + return pfn < max_pfn; #else + unsigned long paddr = (pfn << PAGE_SHIFT); int i; for (i=0; i < lmb.memory.cnt; i++) { unsigned long base;