aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJeffrey Deans <jeffrey.deans@imgtec.com>2014-07-17 04:20:56 -0400
committerRalf Baechle <ralf@linux-mips.org>2014-07-31 07:58:14 -0400
commitffc8415afab20bd97754efae6aad1f67b531132b (patch)
tree2988b6633eb6d1c944608fc2cf258308816a0bc4
parent2e5767a27337812f6850b3fa362419e2f085e5c3 (diff)
MIPS: GIC: Prevent array overrun
A GIC interrupt which is declared as having a GIC_MAP_TO_NMI_MSK mapping causes the cpu parameter to gic_setup_intr() to be increased to 32, causing memory corruption when pcpu_masks[] is written to again later in the function. Signed-off-by: Jeffrey Deans <jeffrey.deans@imgtec.com> Signed-off-by: Markos Chandras <markos.chandras@imgtec.com> Cc: stable@vger.kernel.org Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/7375/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
-rw-r--r--arch/mips/kernel/irq-gic.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/arch/mips/kernel/irq-gic.c b/arch/mips/kernel/irq-gic.c
index 88e4c323382c..d5e59b8f4863 100644
--- a/arch/mips/kernel/irq-gic.c
+++ b/arch/mips/kernel/irq-gic.c
@@ -269,11 +269,13 @@ static void __init gic_setup_intr(unsigned int intr, unsigned int cpu,
269 269
270 /* Setup Intr to Pin mapping */ 270 /* Setup Intr to Pin mapping */
271 if (pin & GIC_MAP_TO_NMI_MSK) { 271 if (pin & GIC_MAP_TO_NMI_MSK) {
272 int i;
273
272 GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_MAP_TO_PIN(intr)), pin); 274 GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_MAP_TO_PIN(intr)), pin);
273 /* FIXME: hack to route NMI to all cpu's */ 275 /* FIXME: hack to route NMI to all cpu's */
274 for (cpu = 0; cpu < NR_CPUS; cpu += 32) { 276 for (i = 0; i < NR_CPUS; i += 32) {
275 GICWRITE(GIC_REG_ADDR(SHARED, 277 GICWRITE(GIC_REG_ADDR(SHARED,
276 GIC_SH_MAP_TO_VPE_REG_OFF(intr, cpu)), 278 GIC_SH_MAP_TO_VPE_REG_OFF(intr, i)),
277 0xffffffff); 279 0xffffffff);
278 } 280 }
279 } else { 281 } else {