* [PATCH 1/1] arm/mach-vexpress: array accessed out of bounds
@ 2014-04-13 17:31 xypron.glpk at gmx.de
2014-04-13 17:39 ` Nicolas Pitre
0 siblings, 1 reply; 3+ messages in thread
From: xypron.glpk at gmx.de @ 2014-04-13 17:31 UTC (permalink / raw)
To: linux-arm-kernel
From: Heinrich Schuchardt <xypron.glpk@gmx.de>
dcscb_allcpus_mask is an array of size 2.
The index variable cluster has to be checked against this limit
before accessing the array.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
---
arch/arm/mach-vexpress/dcscb.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c
index 14d4996..5cbf7fa 100644
--- a/arch/arm/mach-vexpress/dcscb.c
+++ b/arch/arm/mach-vexpress/dcscb.c
@@ -51,12 +51,14 @@ static int dcscb_allcpus_mask[2];
static int dcscb_power_up(unsigned int cpu, unsigned int cluster)
{
unsigned int rst_hold, cpumask = (1 << cpu);
- unsigned int all_mask = dcscb_allcpus_mask[cluster];
+ unsigned int all_mask;
pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster);
if (cpu >= 4 || cluster >= 2)
return -EINVAL;
+ all_mask = dcscb_allcpus_mask[cluster];
+
/*
* Since this is called with IRQs enabled, and no arch_spin_lock_irq
* variant exists, we need to disable IRQs manually here.
@@ -101,11 +103,12 @@ static void dcscb_power_down(void)
cpu = MPIDR_AFFINITY_LEVEL(mpidr, 0);
cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
cpumask = (1 << cpu);
- all_mask = dcscb_allcpus_mask[cluster];
pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster);
BUG_ON(cpu >= 4 || cluster >= 2);
+ all_mask = dcscb_allcpus_mask[cluster];
+
__mcpm_cpu_going_down(cpu, cluster);
arch_spin_lock(&dcscb_lock);
--
1.7.10.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 1/1] arm/mach-vexpress: array accessed out of bounds
2014-04-13 17:31 [PATCH 1/1] arm/mach-vexpress: array accessed out of bounds xypron.glpk at gmx.de
@ 2014-04-13 17:39 ` Nicolas Pitre
2014-04-14 7:42 ` Heinrich Schuchardt
0 siblings, 1 reply; 3+ messages in thread
From: Nicolas Pitre @ 2014-04-13 17:39 UTC (permalink / raw)
To: linux-arm-kernel
On Sun, 13 Apr 2014, xypron.glpk at gmx.de wrote:
> From: Heinrich Schuchardt <xypron.glpk@gmx.de>
>
> dcscb_allcpus_mask is an array of size 2.
>
> The index variable cluster has to be checked against this limit
> before accessing the array.
>
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Acked-by: Nicolas Pitre <nico@linaro.org>
Please send it to the ARM-SOC team.
> ---
> arch/arm/mach-vexpress/dcscb.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c
> index 14d4996..5cbf7fa 100644
> --- a/arch/arm/mach-vexpress/dcscb.c
> +++ b/arch/arm/mach-vexpress/dcscb.c
> @@ -51,12 +51,14 @@ static int dcscb_allcpus_mask[2];
> static int dcscb_power_up(unsigned int cpu, unsigned int cluster)
> {
> unsigned int rst_hold, cpumask = (1 << cpu);
> - unsigned int all_mask = dcscb_allcpus_mask[cluster];
> + unsigned int all_mask;
>
> pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster);
> if (cpu >= 4 || cluster >= 2)
> return -EINVAL;
>
> + all_mask = dcscb_allcpus_mask[cluster];
> +
> /*
> * Since this is called with IRQs enabled, and no arch_spin_lock_irq
> * variant exists, we need to disable IRQs manually here.
> @@ -101,11 +103,12 @@ static void dcscb_power_down(void)
> cpu = MPIDR_AFFINITY_LEVEL(mpidr, 0);
> cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
> cpumask = (1 << cpu);
> - all_mask = dcscb_allcpus_mask[cluster];
>
> pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster);
> BUG_ON(cpu >= 4 || cluster >= 2);
>
> + all_mask = dcscb_allcpus_mask[cluster];
> +
> __mcpm_cpu_going_down(cpu, cluster);
>
> arch_spin_lock(&dcscb_lock);
> --
> 1.7.10.4
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 1/1] arm/mach-vexpress: array accessed out of bounds
2014-04-13 17:39 ` Nicolas Pitre
@ 2014-04-14 7:42 ` Heinrich Schuchardt
0 siblings, 0 replies; 3+ messages in thread
From: Heinrich Schuchardt @ 2014-04-14 7:42 UTC (permalink / raw)
To: linux-arm-kernel
(Forwarding to arm at kernel.org)
dcscb_allcpus_mask is an array of size 2.
The index variable cluster has to be checked against this limit
before accessing the array.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Acked-by: Nicolas Pitre <nico@linaro.org>
---
arch/arm/mach-vexpress/dcscb.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c
index 16d57a8..a76b44c 100644
--- a/arch/arm/mach-vexpress/dcscb.c
+++ b/arch/arm/mach-vexpress/dcscb.c
@@ -51,12 +51,14 @@ static int dcscb_allcpus_mask[2];
static int dcscb_power_up(unsigned int cpu, unsigned int cluster)
{
unsigned int rst_hold, cpumask = (1 << cpu);
- unsigned int all_mask = dcscb_allcpus_mask[cluster];
+ unsigned int all_mask;
pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster);
if (cpu >= 4 || cluster >= 2)
return -EINVAL;
+ all_mask = dcscb_allcpus_mask[cluster];
+
/*
* Since this is called with IRQs enabled, and no arch_spin_lock_irq
* variant exists, we need to disable IRQs manually here.
@@ -101,11 +103,12 @@ static void dcscb_power_down(void)
cpu = MPIDR_AFFINITY_LEVEL(mpidr, 0);
cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
cpumask = (1 << cpu);
- all_mask = dcscb_allcpus_mask[cluster];
pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster);
BUG_ON(cpu >= 4 || cluster >= 2);
+ all_mask = dcscb_allcpus_mask[cluster];
+
__mcpm_cpu_going_down(cpu, cluster);
arch_spin_lock(&dcscb_lock);
--
1.7.10.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-04-14 7:42 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-04-13 17:31 [PATCH 1/1] arm/mach-vexpress: array accessed out of bounds xypron.glpk at gmx.de
2014-04-13 17:39 ` Nicolas Pitre
2014-04-14 7:42 ` Heinrich Schuchardt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).