lkml.org 
[lkml]   [2014]   [Jul]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.13 191/198] MIPS: MSC: Prevent out-of-bounds writes to MIPS SC ioremap'd region
    Date
    3.13.11.5 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Markos Chandras <markos.chandras@imgtec.com>

    commit ab6c15bc6620ebe220970cc040b29bcb2757f373 upstream.

    Previously, the lower limit for the MIPS SC initialization loop was
    set incorrectly allowing one extra loop leading to writes
    beyond the MSC ioremap'd space. More precisely, the value of the 'imp'
    in the last loop increased beyond the msc_irqmap_t boundaries and
    as a result of which, the 'n' variable was loaded with an incorrect
    value. This value was used later on to calculate the offset in the
    MSC01_IC_SUP which led to random crashes like the following one:

    CPU 0 Unable to handle kernel paging request at virtual address e75c0200,
    epc == 8058dba4, ra == 8058db90
    [...]
    Call Trace:
    [<8058dba4>] init_msc_irqs+0x104/0x154
    [<8058b5bc>] arch_init_irq+0xd8/0x154
    [<805897b0>] start_kernel+0x220/0x36c

    Kernel panic - not syncing: Attempted to kill the idle task!

    This patch fixes the problem

    Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
    Reviewed-by: James Hogan <james.hogan@imgtec.com>
    Cc: linux-mips@linux-mips.org
    Patchwork: https://patchwork.linux-mips.org/patch/7118/
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    arch/mips/kernel/irq-msc01.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/arch/mips/kernel/irq-msc01.c b/arch/mips/kernel/irq-msc01.c
    index fab40f7..ac9facc 100644
    --- a/arch/mips/kernel/irq-msc01.c
    +++ b/arch/mips/kernel/irq-msc01.c
    @@ -131,7 +131,7 @@ void __init init_msc_irqs(unsigned long icubase, unsigned int irqbase, msc_irqma

    board_bind_eic_interrupt = &msc_bind_eic_interrupt;

    - for (; nirq >= 0; nirq--, imp++) {
    + for (; nirq > 0; nirq--, imp++) {
    int n = imp->im_irq;

    switch (imp->im_type) {
    --
    1.9.1


    \
     
     \ /
      Last update: 2014-07-16 01:01    [W:2.340 / U:1.460 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site