Skip to content

Commit

Permalink
arm64: Survive invalid cpu enable-methods
Browse files Browse the repository at this point in the history
Currently, if you pass the kernel a dtb where a cpu node has an
unsupported enable-method property (e.g. "not-psci"), it'll explode
horribly, as it iterates over the enable_ops array incorrectly. It
increments the pointer *at* the current element, rather than
incrementing the pointer *to* the current element. As the first two
elements pointed to structures that were contiguous in memory, this
happened to be equivalent. However the third element is NULL, so when
the list is exhausted, smp_get_enable_ops generates the wrong pointer,
and dereferences an arbitrary portion of memory, which currently happens
to contain zero.

This patch fixes this by indirecting the pointer one level, so we
iterate over the array elements correctly, avoiding the below panic:

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
  • Loading branch information
Mark Rutland authored and Catalin Marinas committed Apr 25, 2013
1 parent 4339e3f commit 39a90ca
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions arch/arm64/kernel/smp.c
Original file line number Diff line number Diff line change
Expand Up @@ -245,11 +245,11 @@ static const struct smp_enable_ops *smp_enable_ops[NR_CPUS];

static const struct smp_enable_ops * __init smp_get_enable_ops(const char *name)
{
const struct smp_enable_ops *ops = enable_ops[0];
const struct smp_enable_ops **ops = enable_ops;

while (ops) {
if (!strcmp(name, ops->name))
return ops;
while (*ops) {
if (!strcmp(name, (*ops)->name))
return *ops;

ops++;
}
Expand Down

0 comments on commit 39a90ca

Please sign in to comment.