• Andi Kleen's avatar
    x86: Fix ioremap off by one BUG · e213e877
    Andi Kleen authored
    Jean Delvare's machine triggered this BUG
    
    acpi_os_map_memory phys ffff0000 size 65535
    ------------[ cut here ]------------
    kernel BUG at arch/x86/mm/pat.c:233!
    
    with ACPI in the backtrace.
    
    Adding some debugging output showed that ACPI calls
    
    acpi_os_map_memory phys ffff0000 size 65535
    
    And ioremap/PAT does this check in 32bit, so addr+size wraps and the BUG
    in reserve_memtype() triggers incorrectly.
    
            BUG_ON(start >= end); /* end is exclusive */
    
    But reserve_memtype already uses u64:
    
    int reserve_memtype(u64 start, u64 end,
    
    so the 32bit truncation must happen in the caller. Presumably in ioremap
    when it passes this information to reserve_memtype().
    
    This patch does this computation in 64bit.
    
    http://bugzilla.kernel.org/show_bug.cgi?id=11346Signed-off-by: default avatarAndi Kleen <ak@linux.intel.com>
    e213e877
ioremap.c 15.9 KB