aboutsummaryrefslogtreecommitdiffstats
path: root/arch/arm64
diff options
context:
space:
mode:
authorMark Rutland <mark.rutland@arm.com>2013-04-23 17:22:49 +0100
committerCatalin Marinas <catalin.marinas@arm.com>2013-04-25 17:45:54 +0100
commit39a90ca639db5fcd33064ddf754793ec85764239 (patch)
treed8a153f03d0a47872729c6cff6b00191da220593 /arch/arm64
parentarm64: mm: Correct show_pte behaviour (diff)
downloadlinux-dev-39a90ca639db5fcd33064ddf754793ec85764239.tar.xz
linux-dev-39a90ca639db5fcd33064ddf754793ec85764239.zip
arm64: Survive invalid cpu enable-methods
Currently, if you pass the kernel a dtb where a cpu node has an unsupported enable-method property (e.g. "not-psci"), it'll explode horribly, as it iterates over the enable_ops array incorrectly. It increments the pointer *at* the current element, rather than incrementing the pointer *to* the current element. As the first two elements pointed to structures that were contiguous in memory, this happened to be equivalent. However the third element is NULL, so when the list is exhausted, smp_get_enable_ops generates the wrong pointer, and dereferences an arbitrary portion of memory, which currently happens to contain zero. This patch fixes this by indirecting the pointer one level, so we iterate over the array elements correctly, avoiding the below panic: Signed-off-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Diffstat (limited to 'arch/arm64')
-rw-r--r--arch/arm64/kernel/smp.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index a886194e58fd..1e22ff9ae153 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -245,11 +245,11 @@ static const struct smp_enable_ops *smp_enable_ops[NR_CPUS];
static const struct smp_enable_ops * __init smp_get_enable_ops(const char *name)
{
- const struct smp_enable_ops *ops = enable_ops[0];
+ const struct smp_enable_ops **ops = enable_ops;
- while (ops) {
- if (!strcmp(name, ops->name))
- return ops;
+ while (*ops) {
+ if (!strcmp(name, (*ops)->name))
+ return *ops;
ops++;
}