From patchwork Wed Nov 21 16:42:56 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Pieralisi X-Patchwork-Id: 1781671 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) by patchwork2.kernel.org (Postfix) with ESMTP id 1EFDCDFF71 for ; Wed, 21 Nov 2012 16:45:20 +0000 (UTC) Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.76 #1 (Red Hat Linux)) id 1TbDOI-0007lA-SY; Wed, 21 Nov 2012 16:43:10 +0000 Received: from service87.mimecast.com ([91.220.42.44]) by merlin.infradead.org with esmtp (Exim 4.76 #1 (Red Hat Linux)) id 1TbDOF-0007kk-QV for linux-arm-kernel@lists.infradead.org; Wed, 21 Nov 2012 16:43:09 +0000 Received: from cam-owa2.Emea.Arm.com (fw-tnat.cambridge.arm.com [217.140.96.21]) by service87.mimecast.com; Wed, 21 Nov 2012 16:43:00 +0000 Received: from e102568-lin.cambridge.arm.com ([10.1.255.212]) by cam-owa2.Emea.Arm.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 21 Nov 2012 16:43:00 +0000 From: Lorenzo Pieralisi To: linux@arm.linux.org.uk Subject: [PATCH] ARM: kernel: fix nr_cpu_ids check in DT logical map init Date: Wed, 21 Nov 2012 16:42:56 +0000 Message-Id: <1353516176-12929-1-git-send-email-lorenzo.pieralisi@arm.com> X-Mailer: git-send-email 1.7.12 X-OriginalArrivalTime: 21 Nov 2012 16:43:00.0750 (UTC) FILETIME=[44C1F2E0:01CDC807] X-MC-Unique: 112112116430100101 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20121121_114308_083473_781FEC27 X-CRM114-Status: GOOD ( 13.50 ) X-Spam-Score: -2.6 (--) X-Spam-Report: SpamAssassin version 3.3.2 on merlin.infradead.org summary: Content analysis details: (-2.6 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [91.220.42.44 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] Cc: devicetree-discuss@lists.ozlabs.org, Lorenzo Pieralisi , linux-arm-kernel@lists.infradead.org X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: linux-arm-kernel-bounces@lists.infradead.org Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org If a kernel is configured with a DT containing more /cpu nodes than nr_cpu_ids, the number of cpus must be capped in the DT parsing code. Current code carries out the check, but fails to cap the value and the check is executed after the cpu logical index is used, which can lead to memory corruption due to index overflow. This patch refactors the check against nr_cpu_ids and move it before any computed index is used in the parsing code. Signed-off-by: Lorenzo Pieralisi Reported-by: Mark Rutland Acked-by: Grant Likely --- Russell, while refactoring the DT loop over nodes, I unfortunately missed this niggle in the parsing loop that Mark reported. Here is the fix, sorry for the additional commit, if it is ok for you I will add it to your patch system. Apologies and thanks, Lorenzo arch/arm/kernel/devtree.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c index aaf9add..70f1bde 100644 --- a/arch/arm/kernel/devtree.c +++ b/arch/arm/kernel/devtree.c @@ -139,10 +139,14 @@ void __init arm_dt_init_cpu_maps(void) i = cpuidx++; } - tmp_map[i] = hwid; - - if (cpuidx > nr_cpu_ids) + if (WARN(cpuidx > nr_cpu_ids, "DT /cpu %u nodes greater than " + "max cores %u, capping them\n", + cpuidx, nr_cpu_ids)) { + cpuidx = nr_cpu_ids; break; + } + + tmp_map[i] = hwid; } if (WARN(!bootcpu_valid, "DT missing boot CPU MPIDR[23:0], "