From 54be09cd8f6e66f59144f9e5861b0252ed441d89 Mon Sep 17 00:00:00 2001 From: Patrick Delaunay Date: Fri, 24 Apr 2020 20:20:17 +0200 Subject: [PATCH] arm: caches: manage phys_addr_t overflow in mmu_set_region_dcache_behaviour Solved the overflow on phys_addr_t type for start + size in mmu_set_region_dcache_behaviour() function. This overflow is avoided by dividing start and end by 2 before addition, and we only expecting that start and size are even. This patch doesn't change the current function behavior if the parameters (start or size) are not aligned on MMU_SECTION_SIZE. For example, this overflow occurs on ARM32 with: start = 0xC0000000 and size = 0x40000000 then start + size = 0x100000000 and end = 0x0. For information the function behavior change with risk of regression, if we just shift start and size before the addition. Example with 2MB section size: MMU_SECTION_SIZE 0x200000 and MMU_SECTION_SHIFT = 21 with start = 0x1000000, size = 0x1000000, - with the proposed patch, start = 0 and end = 0x1 as previously - with the more simple patch: end = (start >> MMU_SECTION_SHIFT) + (size >> MMU_SECTION_SHIFT) the value of end change: start >> 21 = 0, size >> 21 = 0 and end = 0x0 !!! Signed-off-by: Patrick Delaunay --- arch/arm/lib/cache-cp15.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/arm/lib/cache-cp15.c b/arch/arm/lib/cache-cp15.c index d15144188b..f803d6fb8c 100644 --- a/arch/arm/lib/cache-cp15.c +++ b/arch/arm/lib/cache-cp15.c @@ -61,8 +61,11 @@ void mmu_set_region_dcache_behaviour(phys_addr_t start, size_t size, unsigned long startpt, stoppt; unsigned long upto, end; - end = ALIGN(start + size, MMU_SECTION_SIZE) >> MMU_SECTION_SHIFT; + /* div by 2 before start + size to avoid phys_addr_t overflow */ + end = ALIGN((start / 2) + (size / 2), MMU_SECTION_SIZE / 2) + >> (MMU_SECTION_SHIFT - 1); start = start >> MMU_SECTION_SHIFT; + #ifdef CONFIG_ARMV7_LPAE debug("%s: start=%pa, size=%zu, option=%llx\n", __func__, &start, size, option); -- 2.39.5