Skip to content

Commit

Permalink
[ARM] 5560/1: Avoid buffer overrun in case of an invalid IRQ
Browse files Browse the repository at this point in the history
handle_bad_irq() expects the IRQ number to be valid (used for statistics),
so it cannot be called with an illegal vector. The problem was reported
by a static analysis tool.

The change makes bad_irq_desc redundant, so delete it.

Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
  • Loading branch information
Aaro Koskinen authored and Russell King committed Jun 25, 2009
1 parent 8fd3ec6 commit 7aa5514
Showing 1 changed file with 6 additions and 18 deletions.
24 changes: 6 additions & 18 deletions arch/arm/kernel/irq.c
Original file line number Diff line number Diff line change
Expand Up @@ -98,17 +98,6 @@ int show_interrupts(struct seq_file *p, void *v)
return 0;
}

/* Handle bad interrupts */
static struct irq_desc bad_irq_desc = {
.handle_irq = handle_bad_irq,
.lock = __SPIN_LOCK_UNLOCKED(bad_irq_desc.lock),
};

#ifdef CONFIG_CPUMASK_OFFSTACK
/* We are not allocating bad_irq_desc.affinity or .pending_mask */
#error "ARM architecture does not support CONFIG_CPUMASK_OFFSTACK."
#endif

/*
* do_IRQ handles all hardware IRQ's. Decoded IRQs should not
* come via this function. Instead, they should provide their
Expand All @@ -124,10 +113,13 @@ asmlinkage void __exception asm_do_IRQ(unsigned int irq, struct pt_regs *regs)
* Some hardware gives randomly wrong interrupts. Rather
* than crashing, do something sensible.
*/
if (irq >= NR_IRQS)
handle_bad_irq(irq, &bad_irq_desc);
else
if (unlikely(irq >= NR_IRQS)) {
if (printk_ratelimit())
printk(KERN_WARNING "Bad IRQ%u\n", irq);
ack_bad_irq(irq);
} else {
generic_handle_irq(irq);
}

/* AT91 specific workaround */
irq_finish(irq);
Expand Down Expand Up @@ -165,10 +157,6 @@ void __init init_IRQ(void)
for (irq = 0; irq < NR_IRQS; irq++)
irq_desc[irq].status |= IRQ_NOREQUEST | IRQ_NOPROBE;

#ifdef CONFIG_SMP
cpumask_setall(bad_irq_desc.affinity);
bad_irq_desc.node = smp_processor_id();
#endif
init_arch_irq();
}

Expand Down

0 comments on commit 7aa5514

Please sign in to comment.