hvc_iucv: allocate memory buffers for IUCV in zone DMA

commit 91a970d9889c7d6f451ee91ed361d0f0119d3778 upstream.

The device driver must allocate memory for IUCV buffers with GFP_DMA,
because IUCV cannot address memory above 2GB (31bit addresses only).

Because the IUCV ignores the higher bits of the address, sending and
receiving IUCV data with this driver might cause memory corruptions.

Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: maximilian attems <max@stro.at>

diff --git a/drivers/char/hvc_iucv.c b/drivers/char/hvc_iucv.c
index fe62bd0e17b751f55e359addc54ee4569a4f7488..170cc4bde498d47d95ce1a5b438178a9a62d943f 100644 (file)
--- a/drivers/char/hvc_iucv.c
+++ b/drivers/char/hvc_iucv.c
@@ -139,6 +139,8 @@ struct hvc_iucv_private *hvc_iucv_get_private(uint32_t num)
  *
  * This function allocates a new struct iucv_tty_buffer element and, optionally,
  * allocates an internal data buffer with the specified size @size.
+ * The internal data buffer is always allocated with GFP_DMA which is
+ * required for receiving and sending data with IUCV.
  * Note: The total message size arises from the internal buffer size and the
  *      members of the iucv_tty_msg structure.
  * The function returns NULL if memory allocation has failed.
@@ -154,7 +156,7 @@ static struct iucv_tty_buffer *alloc_tty_buffer(size_t size, gfp_t flags)
 
        if (size > 0) {
                bufp->msg.length = MSG_SIZE(size);
-               bufp->mbuf = kmalloc(bufp->msg.length, flags);
+               bufp->mbuf = kmalloc(bufp->msg.length, flags | GFP_DMA);
                if (!bufp->mbuf) {
                        mempool_free(bufp, hvc_iucv_mempool);
                        return NULL;
@@ -237,7 +239,7 @@ static int hvc_iucv_write(struct hvc_iucv_private *priv,
        if (!rb->mbuf) { /* message not yet received ... */
                /* allocate mem to store msg data; if no memory is available
                 * then leave the buffer on the list and re-try later */
-               rb->mbuf = kmalloc(rb->msg.length, GFP_ATOMIC);
+               rb->mbuf = kmalloc(rb->msg.length, GFP_ATOMIC | GFP_DMA);
                if (!rb->mbuf)
                        return -ENOMEM;