Skip to content

Commit

Permalink
x86: fix alloc_mptable()
Browse files Browse the repository at this point in the history
Fix the conditions when we stop updating the mptable due to
running out of slots.

[ Impact: fix memory corruption / non-working update_mptable boot parameter ]

Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: Len Brown <lenb@kernel.org>
LKML-Reference: <4A01C3BB.1000609@kernel.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
  • Loading branch information
Yinghai Lu authored and Ingo Molnar committed May 11, 2009
1 parent b9e0353 commit ee21455
Showing 1 changed file with 9 additions and 16 deletions.
25 changes: 9 additions & 16 deletions arch/x86/kernel/mpparse.c
Original file line number Diff line number Diff line change
Expand Up @@ -870,24 +870,17 @@ static
inline void __init check_irq_src(struct mpc_intsrc *m, int *nr_m_spare) {}
#endif /* CONFIG_X86_IO_APIC */

static int check_slot(unsigned long mpc_new_phys, unsigned long mpc_new_length,
int count)
static int
check_slot(unsigned long mpc_new_phys, unsigned long mpc_new_length, int count)
{
if (!mpc_new_phys) {
pr_info("No spare slots, try to append...take your risk, "
"new mpc_length %x\n", count);
} else {
if (count <= mpc_new_length)
pr_info("No spare slots, try to append..., "
"new mpc_length %x\n", count);
else {
pr_err("mpc_new_length %lx is too small\n",
mpc_new_length);
return -1;
}
int ret = 0;

if (!mpc_new_phys || count <= mpc_new_length) {
WARN(1, "update_mptable: No spare slots (length: %x)\n", count);
return -1;
}

return 0;
return ret;
}

static int __init replace_intsrc_all(struct mpc_table *mpc,
Expand Down Expand Up @@ -946,7 +939,7 @@ static int __init replace_intsrc_all(struct mpc_table *mpc,
} else {
struct mpc_intsrc *m = (struct mpc_intsrc *)mpt;
count += sizeof(struct mpc_intsrc);
if (!check_slot(mpc_new_phys, mpc_new_length, count))
if (check_slot(mpc_new_phys, mpc_new_length, count) < 0)
goto out;
assign_to_mpc_intsrc(&mp_irqs[i], m);
mpc->length = count;
Expand Down

0 comments on commit ee21455

Please sign in to comment.