[S390] hvc_iucv: allocate memory buffers for IUCV in zone DMA

The device driver must allocate memory for IUCV buffers with GFP_DMA,
because IUCV cannot address memory above 2GB (31bit addresses only).

Because the IUCV ignores the higher bits of the address, sending and
receiving IUCV data with this driver might cause memory corruptions.

Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

1 files changed, 4 insertions, 2 deletions

diff --git a/drivers/char/hvc_iucv.c b/drivers/char/hvc_iucv.c
index 21681a81cc35..37b0542a4eeb 100644
--- a/drivers/char/hvc_iucv.c
+++ b/drivers/char/hvc_iucv.c
@@ -139,6 +139,8 @@ struct hvc_iucv_private *hvc_iucv_get_private(uint32_t num)
  *
  * This function allocates a new struct iucv_tty_buffer element and, optionally,
  * allocates an internal data buffer with the specified size @size.
+ * The internal data buffer is always allocated with GFP_DMA which is
+ * required for receiving and sending data with IUCV.
  * Note: The total message size arises from the internal buffer size and the
  *       members of the iucv_tty_msg structure.
  * The function returns NULL if memory allocation has failed.
@@ -154,7 +156,7 @@ static struct iucv_tty_buffer *alloc_tty_buffer(size_t size, gfp_t flags)
 
         if (size > 0) {
                 bufp->msg.length = MSG_SIZE(size);
-                bufp->mbuf = kmalloc(bufp->msg.length, flags);
+                bufp->mbuf = kmalloc(bufp->msg.length, flags | GFP_DMA);
                 if (!bufp->mbuf) {
                         mempool_free(bufp, hvc_iucv_mempool);
                         return NULL;
@@ -237,7 +239,7 @@ static int hvc_iucv_write(struct hvc_iucv_private *priv,
         if (!rb->mbuf) { /* message not yet received ... */
                 /* allocate mem to store msg data; if no memory is available
                  * then leave the buffer on the list and re-try later */
-                rb->mbuf = kmalloc(rb->msg.length, GFP_ATOMIC);
+                rb->mbuf = kmalloc(rb->msg.length, GFP_ATOMIC | GFP_DMA);
                 if (!rb->mbuf)
                         return -ENOMEM;