On Thursday, October 2, 2008 4:30 pm Linus Torvalds wrote:
quoted text > On Thu, 2 Oct 2008, Jesse Barnes wrote:
> > + unsigned long map_len = vma->vm_end - vma->vm_start;
> > + unsigned long map_offset = vma->vm_pgoff << PAGE_SHIFT;
>
> This seems broken for big vm_pgoff values, where that shift will
> potentially overflow, no?
Ah yes, exactly what we want to be checking for in fact.
quoted text > Also, it strikes me that we don't seem to check that the resource start is
> page-aligned. We just do
>
> vma->vm_pgoff += start >> PAGE_SHIFT;
>
> without checking if we just dropped low bits from 'start'.
Hm, yeah looks like that's a long standing issue...
quoted text > Of course, if the length of the resource is bigger than a page, I guess
> the resource is guaranteed to be at least page-aligned, so maybe the
> length check - if it was correct - would be sufficient.
>
> Anyway, it would be *much* better to do the length check in pages rather
> than in bytes, to avoid the overflow condition.
>
> Can somebody test if something like this works? It also prints the actual
> name of the device, not just a random BAR number (but it will print
> everyting in PFN's, I hate potentially losing information).
Yeah, looks much better. I was using this silly test program to see if the
earlier code worked. Just pass in both valid and invalid sizes.
Jesse
