From patchwork Thu Apr 24 16:40:16 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pawel Moll X-Patchwork-Id: 28998 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-ob0-f197.google.com (mail-ob0-f197.google.com [209.85.214.197]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 907702036A for ; Thu, 24 Apr 2014 16:42:34 +0000 (UTC) Received: by mail-ob0-f197.google.com with SMTP id wp4sf15398878obc.0 for ; Thu, 24 Apr 2014 09:42:34 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:delivered-to:from:to:subject:date:message-id :in-reply-to:references:cc:precedence:list-id:list-unsubscribe :list-archive:list-post:list-help:list-subscribe:mime-version:sender :errors-to:x-original-sender:x-original-authentication-results :mailing-list:content-type:content-transfer-encoding; bh=QESGBfFAT4fb1rbdt9syHF4lCUIz10Duz2v2qj7BWXg=; b=QDsloB+CPiRh50ZEwXrBK+Wp6D4HNWTQdiSfYZDxpSXKZWUUqK+nV9o5xGz1ujv25N SOA7WhKPE4j6yoW+oyT5rFA2HQmctHsFyiZ8ikXcCl6Mt24b2NgCcfXBY08scBRkEOMu OreYqwIw9HqSIwRThj7SRsG3j0fydzdCKd7uY6HuludbX3ApDaNuwvODZe0/iGvJ/CHK KDmWrrsoe5Ob3HQRvzN4Ix49t7lR7zIbq91IX/cNofgxNd8wP+JJgOXk+ujMO1W/C+Nb BDEOl5DYoXDkcp9Sy7TDKF0k20VIOjIuuOLQqtnDthuAAC4YRWizJwY3TIPEgeHNELAj Oczw== X-Gm-Message-State: ALoCoQlNaO8Vc+2W1V/qBb7vLCd6rwmG/kDFSCQw71WvBwAQmZBmsNI2mnPg+r57Jz0274y7pPgq X-Received: by 10.182.186.103 with SMTP id fj7mr1708485obc.9.1398357753973; Thu, 24 Apr 2014 09:42:33 -0700 (PDT) X-BeenThere: patchwork-forward@linaro.org Received: by 10.140.94.118 with SMTP id f109ls1090912qge.8.gmail; Thu, 24 Apr 2014 09:42:33 -0700 (PDT) X-Received: by 10.221.28.202 with SMTP id rv10mr1916236vcb.10.1398357753829; Thu, 24 Apr 2014 09:42:33 -0700 (PDT) Received: from mail-vc0-f170.google.com (mail-vc0-f170.google.com [209.85.220.170]) by mx.google.com with ESMTPS id w19si1050620vcf.167.2014.04.24.09.42.33 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 24 Apr 2014 09:42:33 -0700 (PDT) Received-SPF: none (google.com: patch+caf_=patchwork-forward=linaro.org@linaro.org does not designate permitted sender hosts) client-ip=209.85.220.170; Received: by mail-vc0-f170.google.com with SMTP id hr9so3292412vcb.15 for ; Thu, 24 Apr 2014 09:42:33 -0700 (PDT) X-Received: by 10.58.243.72 with SMTP id ww8mr1029089vec.49.1398357753693; Thu, 24 Apr 2014 09:42:33 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.220.221.72 with SMTP id ib8csp30581vcb; Thu, 24 Apr 2014 09:42:33 -0700 (PDT) X-Received: by 10.224.125.74 with SMTP id x10mr4156256qar.99.1398357752856; Thu, 24 Apr 2014 09:42:32 -0700 (PDT) Received: from bombadil.infradead.org (bombadil.infradead.org. [2001:1868:205::9]) by mx.google.com with ESMTPS id v10si2461266qat.185.2014.04.24.09.42.32 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 24 Apr 2014 09:42:32 -0700 (PDT) Received-SPF: none (google.com: linux-arm-kernel-bounces+patch=linaro.org@lists.infradead.org does not designate permitted sender hosts) client-ip=2001:1868:205::9; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1WdMhc-0000ai-LM; Thu, 24 Apr 2014 16:40:48 +0000 Received: from fw-tnat.austin.arm.com ([217.140.110.23] helo=collaborate-mta1.arm.com) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1WdMhZ-0000SO-RF for linux-arm-kernel@lists.infradead.org; Thu, 24 Apr 2014 16:40:46 +0000 Received: from hornet.Cambridge.Arm.com (hornet.cambridge.arm.com [10.2.201.45]) by collaborate-mta1.arm.com (Postfix) with ESMTP id 5E77413FBAD; Thu, 24 Apr 2014 11:40:21 -0500 (CDT) From: Pawel Moll To: arm@kernel.org Subject: [PATCH 2/4] arm/mach-vexpress: array accessed out of bounds Date: Thu, 24 Apr 2014 17:40:16 +0100 Message-Id: <1398357618-11050-3-git-send-email-pawel.moll@arm.com> X-Mailer: git-send-email 1.8.3.2 In-Reply-To: <1398357618-11050-1-git-send-email-pawel.moll@arm.com> References: <1398357618-11050-1-git-send-email-pawel.moll@arm.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20140424_094045_928206_9D64C2CC X-CRM114-Status: UNSURE ( 9.87 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -0.7 (/) X-Spam-Report: SpamAssassin version 3.3.2 on bombadil.infradead.org summary: Content analysis details: (-0.7 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -0.0 SPF_PASS SPF: sender matches SPF record Cc: Heinrich Schuchardt , Pawel Moll , linux-arm-kernel@lists.infradead.org X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: , List-Help: , List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patch=linaro.org@lists.infradead.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: pawel.moll@arm.com X-Original-Authentication-Results: mx.google.com; spf=neutral (google.com: patch+caf_=patchwork-forward=linaro.org@linaro.org does not designate permitted sender hosts) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 From: Heinrich Schuchardt dcscb_allcpus_mask is an array of size 2. The index variable cluster has to be checked against this limit before accessing the array. Signed-off-by: Heinrich Schuchardt Acked-by: Nicolas Pitre Signed-off-by: Pawel Moll --- arch/arm/mach-vexpress/dcscb.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c index 788495d..30b9933 100644 --- a/arch/arm/mach-vexpress/dcscb.c +++ b/arch/arm/mach-vexpress/dcscb.c @@ -51,12 +51,14 @@ static int dcscb_allcpus_mask[2]; static int dcscb_power_up(unsigned int cpu, unsigned int cluster) { unsigned int rst_hold, cpumask = (1 << cpu); - unsigned int all_mask = dcscb_allcpus_mask[cluster]; + unsigned int all_mask; pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster); if (cpu >= 4 || cluster >= 2) return -EINVAL; + all_mask = dcscb_allcpus_mask[cluster]; + /* * Since this is called with IRQs enabled, and no arch_spin_lock_irq * variant exists, we need to disable IRQs manually here. @@ -101,11 +103,12 @@ static void dcscb_power_down(void) cpu = MPIDR_AFFINITY_LEVEL(mpidr, 0); cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1); cpumask = (1 << cpu); - all_mask = dcscb_allcpus_mask[cluster]; pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster); BUG_ON(cpu >= 4 || cluster >= 2); + all_mask = dcscb_allcpus_mask[cluster]; + __mcpm_cpu_going_down(cpu, cluster); arch_spin_lock(&dcscb_lock);