linuxppc-dev.lists.ozlabs.org archive mirror
 help / color / mirror / Atom feed
From: Alexey Kardashevskiy <aik@ozlabs.ru>
To: linuxppc-dev@lists.ozlabs.org
Cc: "Jose Ricardo Ziviani" <joserz@linux.ibm.com>,
	"Alexey Kardashevskiy" <aik@ozlabs.ru>,
	"Alistair Popple" <alistair@popple.id.au>,
	"Daniel Henrique Barboza" <danielhb413@gmail.com>,
	"Alex Williamson" <alex.williamson@redhat.com>,
	kvm-ppc@vger.kernel.org, "Sam Bobroff" <sbobroff@linux.ibm.com>,
	"Piotr Jaroszynski" <pjaroszynski@nvidia.com>,
	"Leonardo Augusto Guimarães Garcia" <lagarcia@br.ibm.com>,
	"Reza Arbab" <arbab@linux.ibm.com>,
	"David Gibson" <david@gibson.dropbear.id.au>
Subject: [PATCH kernel v5 16/20] powerpc/powernv/npu: Check mmio_atsd array bounds when populating
Date: Thu, 13 Dec 2018 17:17:30 +1100	[thread overview]
Message-ID: <20181213061734.16651-17-aik@ozlabs.ru> (raw)
In-Reply-To: <20181213061734.16651-1-aik@ozlabs.ru>

A broken device tree might contain more than 8 values and introduce hard
to debug memory corruption bug. This adds the boundary check.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---
 arch/powerpc/platforms/powernv/npu-dma.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
index 31dfc11..2c405a4 100644
--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -1179,8 +1179,9 @@ int pnv_npu2_init(struct pci_controller *hose)
 
 	npu->nmmu_flush = of_property_read_bool(hose->dn, "ibm,nmmu-flush");
 
-	for (i = 0; !of_property_read_u64_index(hose->dn, "ibm,mmio-atsd",
-							i, &mmio_atsd); i++)
+	for (i = 0; i < ARRAY_SIZE(npu->mmio_atsd_regs) &&
+			!of_property_read_u64_index(hose->dn, "ibm,mmio-atsd",
+				i, &mmio_atsd); i++)
 		npu->mmio_atsd_regs[i] = ioremap(mmio_atsd, 32);
 
 	pr_info("NPU%d: Found %d MMIO ATSD registers", hose->global_number, i);
-- 
2.17.1


  parent reply	other threads:[~2018-12-13  6:41 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-12-13  6:17 [PATCH kernel v5 00/20] powerpc/powernv/npu, vfio: NVIDIA V100 + P9 passthrough Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 01/20] powerpc/ioda/npu: Call skiboot's hot reset hook when disabling NPU2 Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 02/20] powerpc/mm/iommu/vfio_spapr_tce: Change mm_iommu_get to reference a region Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 03/20] powerpc/vfio/iommu/kvm: Do not pin device memory Alexey Kardashevskiy
2018-12-14  3:18   ` Paul Mackerras
2018-12-18 23:33   ` Michael Ellerman
2018-12-13  6:17 ` [PATCH kernel v5 04/20] powerpc/powernv: Move npu struct from pnv_phb to pci_controller Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 05/20] powerpc/powernv/npu: Move OPAL calls away from context manipulation Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 06/20] powerpc/pseries/iommu: Use memory@ nodes in max RAM address calculation Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 07/20] powerpc/pseries/npu: Enable platform support Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 08/20] powerpc/pseries: Remove IOMMU API support for non-LPAR systems Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 09/20] powerpc/powernv/pseries: Rework device adding to IOMMU groups Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 10/20] powerpc/iommu_api: Move IOMMU groups setup to a single place Alexey Kardashevskiy
2018-12-18 23:35   ` Michael Ellerman
2018-12-19  6:17     ` Alexey Kardashevskiy
2018-12-19  9:51       ` Michael Ellerman
2018-12-13  6:17 ` [PATCH kernel v5 11/20] powerpc/powernv: Reference iommu_table while it is linked to a group Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 12/20] powerpc/powernv/npu: Move single TVE handling to NPU PE Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 13/20] powerpc/powernv/npu: Convert NPU IOMMU helpers to iommu_table_group_ops Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 14/20] powerpc/powernv/npu: Add compound IOMMU groups Alexey Kardashevskiy
2018-12-19  0:17   ` Michael Ellerman
2018-12-19  6:54     ` Alexey Kardashevskiy
2018-12-19 10:00       ` Michael Ellerman
2018-12-20  2:18         ` Alexey Kardashevskiy
2018-12-20  5:33           ` Michael Ellerman
2018-12-13  6:17 ` [PATCH kernel v5 15/20] powerpc/powernv/npu: Add release_ownership hook Alexey Kardashevskiy
2018-12-13  6:17 ` Alexey Kardashevskiy [this message]
2018-12-13  6:17 ` [PATCH kernel v5 17/20] powerpc/powernv/npu: Fault user page into the hypervisor's pagetable Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 18/20] vfio_pci: Allow mapping extra regions Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 19/20] vfio_pci: Allow regions to add own capabilities Alexey Kardashevskiy
2018-12-13  6:17 ` [PATCH kernel v5 20/20] vfio_pci: Add NVIDIA GV100GL [Tesla V100 SXM2] subdriver Alexey Kardashevskiy
2018-12-18 22:37   ` Alex Williamson
2018-12-19  4:36     ` Alexey Kardashevskiy

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181213061734.16651-17-aik@ozlabs.ru \
    --to=aik@ozlabs.ru \
    --cc=alex.williamson@redhat.com \
    --cc=alistair@popple.id.au \
    --cc=arbab@linux.ibm.com \
    --cc=danielhb413@gmail.com \
    --cc=david@gibson.dropbear.id.au \
    --cc=joserz@linux.ibm.com \
    --cc=kvm-ppc@vger.kernel.org \
    --cc=lagarcia@br.ibm.com \
    --cc=linuxppc-dev@lists.ozlabs.org \
    --cc=pjaroszynski@nvidia.com \
    --cc=sbobroff@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).