From 88e9fbe568652dc40c9cea8744b3da9b4d04a00b Mon Sep 17 00:00:00 2001 From: Tycho Nightingale Date: Mon, 3 Jun 2019 19:19:35 +0000 Subject: very large dma mappings can cause integer overflow Reviewed by: kib Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D20505 --- sys/x86/iommu/busdma_dmar.c | 2 +- sys/x86/x86/busdma_bounce.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'sys/x86') diff --git a/sys/x86/iommu/busdma_dmar.c b/sys/x86/iommu/busdma_dmar.c index 7cd68c5d26f3..9790b493e840 100644 --- a/sys/x86/iommu/busdma_dmar.c +++ b/sys/x86/iommu/busdma_dmar.c @@ -686,7 +686,7 @@ dmar_bus_dmamap_load_phys(bus_dma_tag_t dmat, bus_dmamap_t map1, return (ENOMEM); fma = NULL; for (i = 0; i < ma_cnt; i++) { - paddr = pstart + i * PAGE_SIZE; + paddr = pstart + ptoa(i); ma[i] = PHYS_TO_VM_PAGE(paddr); if (ma[i] == NULL || VM_PAGE_TO_PHYS(ma[i]) != paddr) { /* diff --git a/sys/x86/x86/busdma_bounce.c b/sys/x86/x86/busdma_bounce.c index a66881e79b58..7082b7e369d7 100644 --- a/sys/x86/x86/busdma_bounce.c +++ b/sys/x86/x86/busdma_bounce.c @@ -667,7 +667,7 @@ _bus_dmamap_reserve_pages(bus_dma_tag_t dmat, bus_dmamap_t map, int flags) /* * Add a single contiguous physical range to the segment list. */ -static int +static bus_size_t _bus_dmamap_addseg(bus_dma_tag_t dmat, bus_dmamap_t map, vm_paddr_t curaddr, bus_size_t sgsize, bus_dma_segment_t *segs, int *segp) { -- cgit v1.2.3