diff options
author | Hiroshi DOYU <Hiroshi.DOYU@nokia.com> | 2010-02-15 13:03:32 -0500 |
---|---|---|
committer | Tony Lindgren <tony@atomide.com> | 2010-02-15 13:03:32 -0500 |
commit | c127c7dc1abb7f02dcfbbea173e7abb4f2d4585e (patch) | |
tree | 0d50ffccf7c1c5f1e4d15a0785c2670565dca78e /arch/arm/plat-omap | |
parent | 8d33ea5881bce56f85de7fcc90e1c5618fa5b62d (diff) |
omap iommu: fix incorrect address for largepage 1st entry
There was a potential risk that the following "memset" could override
its range if a given address was not the 1st entry of a
largepage. This is not the case for "iovmm".
Reported-by: Hari Nagalla <hnagalla@ti.com>
Signed-off-by: Hiroshi DOYU <Hiroshi.DOYU@nokia.com>
Signed-off-by: Hari Nagalla <hnagalla@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Diffstat (limited to 'arch/arm/plat-omap')
-rw-r--r-- | arch/arm/plat-omap/iommu.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/arm/plat-omap/iommu.c b/arch/arm/plat-omap/iommu.c index e74811920668..905ed832df56 100644 --- a/arch/arm/plat-omap/iommu.c +++ b/arch/arm/plat-omap/iommu.c | |||
@@ -1,7 +1,7 @@ | |||
1 | /* | 1 | /* |
2 | * omap iommu: tlb and pagetable primitives | 2 | * omap iommu: tlb and pagetable primitives |
3 | * | 3 | * |
4 | * Copyright (C) 2008-2009 Nokia Corporation | 4 | * Copyright (C) 2008-2010 Nokia Corporation |
5 | * | 5 | * |
6 | * Written by Hiroshi DOYU <Hiroshi.DOYU@nokia.com>, | 6 | * Written by Hiroshi DOYU <Hiroshi.DOYU@nokia.com>, |
7 | * Paul Mundt and Toshihiro Kobayashi | 7 | * Paul Mundt and Toshihiro Kobayashi |
@@ -646,7 +646,7 @@ static size_t iopgtable_clear_entry_core(struct iommu *obj, u32 da) | |||
646 | if (*iopte & IOPTE_LARGE) { | 646 | if (*iopte & IOPTE_LARGE) { |
647 | nent *= 16; | 647 | nent *= 16; |
648 | /* rewind to the 1st entry */ | 648 | /* rewind to the 1st entry */ |
649 | iopte = (u32 *)((u32)iopte & IOLARGE_MASK); | 649 | iopte = iopte_offset(iopgd, (da & IOLARGE_MASK)); |
650 | } | 650 | } |
651 | bytes *= nent; | 651 | bytes *= nent; |
652 | memset(iopte, 0, nent * sizeof(*iopte)); | 652 | memset(iopte, 0, nent * sizeof(*iopte)); |