iommu/amd: Handle integer overflow in dma_ops_area_alloc

Handle this case to make sure boundary_size does not become
0 and trigger a BUG_ON later.

Signed-off-by: Joerg Roedel <jroedel@suse.de>

diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index aa710b095f1a606c2fb42ebdb821ba3bf2881a4b..4dfadcfed34ae55dc2cc3dc6553678f340229046 100644 (file)
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -1699,14 +1699,16 @@ static unsigned long dma_ops_area_alloc(struct device *dev,
        unsigned long next_bit = dom->next_address % APERTURE_RANGE_SIZE;
        int max_index = dom->aperture_size >> APERTURE_RANGE_SHIFT;
        int i = start >> APERTURE_RANGE_SHIFT;
-       unsigned long boundary_size;
+       unsigned long boundary_size, mask;
        unsigned long address = -1;
        unsigned long limit;
 
        next_bit >>= PAGE_SHIFT;
 
-       boundary_size = ALIGN(dma_get_seg_boundary(dev) + 1,
-                       PAGE_SIZE) >> PAGE_SHIFT;
+       mask = dma_get_seg_boundary(dev);
+
+       boundary_size = mask + 1 ? ALIGN(mask + 1, PAGE_SIZE) >> PAGE_SHIFT :
+                                  1UL << (BITS_PER_LONG - PAGE_SHIFT);
 
        for (;i < max_index; ++i) {
                unsigned long offset = dom->aperture[i]->offset >> PAGE_SHIFT;