Re: [PATCH v2] ARM: Fix MAX_DMA_ADDRESS overflow

From: Florian Fainelli
Date: Wed Jul 06 2022 - 16:27:18 EST


On 7/6/22 12:44, Geert Uytterhoeven wrote:
Hi Florian,

On Wed, Jul 6, 2022 at 6:46 PM Florian Fainelli <f.fainelli@xxxxxxxxx> wrote:
Commit 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis")
added a check to determine whether arm_dma_zone_size is exceeding the
amount of kernel virtual address space available between the upper 4GB
virtual address limit and PAGE_OFFSET in order to provide a suitable
definition of MAX_DMA_ADDRESS that should fit within the 32-bit virtual
address space. The quantity used for comparison was off by a missing
trailing 0, leading to MAX_DMA_ADDRESS to be overflowing a 32-bit
quantity.

This was caught with the bcm2711 platforms which defines a dma_zone_size
of 1GB, and using a PAGE_OFFSET of 0xc000_0000 (CONFIG_VMSPLIT_3G) with
CONFIG_DEBUG_VIRTUAL enabled would lead to MAX_DMA_ADDRESS being
0x1_0000_0000 which overflows the unsigned long type used throughout
__pa() and __virt_addr_valid(). Because the virtual address passed to
__virt_addr_valid() would now be 0, the function would loudly warn, thus
making the platform unable to boot properly.

Fixes: 26f09e9b3a06 ("mm/memblock: add memblock memory allocation apis")
Signed-off-by: Florian Fainelli <f.fainelli@xxxxxxxxx>
---
Changes in v2:

- simplify the patch and drop the first patch that attempted to fix an
off by one in the calculation.

Thanks for the update!

--- a/arch/arm/include/asm/dma.h
+++ b/arch/arm/include/asm/dma.h
@@ -10,7 +10,7 @@
#else
#define MAX_DMA_ADDRESS ({ \
extern phys_addr_t arm_dma_zone_size; \
- arm_dma_zone_size && arm_dma_zone_size < (0x10000000 - PAGE_OFFSET) ? \
^^^^^^^^^^
0x10000000ULL, as the constant doesn't fit in 32-bit.
However, both gcc (9.4.0) and sparse don't seem to complain about
the missing suffix (anymore?).

Thanks, I will the ULL suffix in v3.
--
Florian