diff options
author | Jeffrey Deans <jeffrey.deans@imgtec.com> | 2014-07-17 04:20:56 -0400 |
---|---|---|
committer | Ralf Baechle <ralf@linux-mips.org> | 2014-07-31 07:58:14 -0400 |
commit | ffc8415afab20bd97754efae6aad1f67b531132b (patch) | |
tree | 2988b6633eb6d1c944608fc2cf258308816a0bc4 | |
parent | 2e5767a27337812f6850b3fa362419e2f085e5c3 (diff) |
MIPS: GIC: Prevent array overrun
A GIC interrupt which is declared as having a GIC_MAP_TO_NMI_MSK
mapping causes the cpu parameter to gic_setup_intr() to be increased
to 32, causing memory corruption when pcpu_masks[] is written to again
later in the function.
Signed-off-by: Jeffrey Deans <jeffrey.deans@imgtec.com>
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Cc: stable@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7375/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
-rw-r--r-- | arch/mips/kernel/irq-gic.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/arch/mips/kernel/irq-gic.c b/arch/mips/kernel/irq-gic.c index 88e4c323382c..d5e59b8f4863 100644 --- a/arch/mips/kernel/irq-gic.c +++ b/arch/mips/kernel/irq-gic.c | |||
@@ -269,11 +269,13 @@ static void __init gic_setup_intr(unsigned int intr, unsigned int cpu, | |||
269 | 269 | ||
270 | /* Setup Intr to Pin mapping */ | 270 | /* Setup Intr to Pin mapping */ |
271 | if (pin & GIC_MAP_TO_NMI_MSK) { | 271 | if (pin & GIC_MAP_TO_NMI_MSK) { |
272 | int i; | ||
273 | |||
272 | GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_MAP_TO_PIN(intr)), pin); | 274 | GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_MAP_TO_PIN(intr)), pin); |
273 | /* FIXME: hack to route NMI to all cpu's */ | 275 | /* FIXME: hack to route NMI to all cpu's */ |
274 | for (cpu = 0; cpu < NR_CPUS; cpu += 32) { | 276 | for (i = 0; i < NR_CPUS; i += 32) { |
275 | GICWRITE(GIC_REG_ADDR(SHARED, | 277 | GICWRITE(GIC_REG_ADDR(SHARED, |
276 | GIC_SH_MAP_TO_VPE_REG_OFF(intr, cpu)), | 278 | GIC_SH_MAP_TO_VPE_REG_OFF(intr, i)), |
277 | 0xffffffff); | 279 | 0xffffffff); |
278 | } | 280 | } |
279 | } else { | 281 | } else { |