lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 8 Oct 2021 19:20:13 -0700 From: Florian Fainelli <f.fainelli@...il.com> To: linux-kernel@...r.kernel.org Cc: Florian Fainelli <f.fainelli@...il.com>, Ray Jui <rjui@...adcom.com>, Scott Branden <sbranden@...adcom.com>, bcm-kernel-feedback-list@...adcom.com (maintainer:BROADCOM BCM281XX/BCM11XXX/BCM216XX ARM ARCHITE...), Russell King <linux@...linux.org.uk>, Catalin Marinas <catalin.marinas@....com>, Will Deacon <will@...nel.org>, Thomas Bogendoerfer <tsbogend@...ha.franken.de>, Thomas Gleixner <tglx@...utronix.de>, Marc Zyngier <maz@...nel.org>, Rob Herring <robh+dt@...nel.org>, Frank Rowand <frowand.list@...il.com>, linux-arm-kernel@...ts.infradead.org (moderated list:ARM SUB-ARCHITECTURES), linux-mips@...r.kernel.org (open list:MIPS), devicetree@...r.kernel.org (open list:OPEN FIRMWARE AND FLATTENED DEVICE TREE) Subject: [PATCH v4 04/14] irqchip/irq-bcm7038-l1: Gate use of CPU logical map to MIPS The use of the cpu_logical_map[] array is only relevant for MIPS based platform where this driver is used as a first level interrupt controller and contains multiple register groups to map with an associated CPU. On ARM/ARM64 based systems this interrupt controller is present and used as a second level interrupt controller hanging off the ARM GIC. That copy of the interrupt controller contains a single group, resulting in the intc->cpus[] array to be of size 1. Things happened to work in that case because we install that interrupt controller as a chained handler which does not allow it to be affine to any CPU but the boot CPU which happens to be 0, therefore we never de-reference past intc->cpus[] but with the current code in place, we do leave a chance of de-referencing the array past its bounds. Signed-off-by: Florian Fainelli <f.fainelli@...il.com> --- drivers/irqchip/irq-bcm7038-l1.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c index 14caf32dc23e..3c4e348c661e 100644 --- a/drivers/irqchip/irq-bcm7038-l1.c +++ b/drivers/irqchip/irq-bcm7038-l1.c @@ -28,9 +28,6 @@ #include <linux/irqchip.h> #include <linux/irqchip/chained_irq.h> #include <linux/syscore_ops.h> -#ifdef CONFIG_ARM -#include <asm/smp_plat.h> -#endif #define IRQS_PER_WORD 32 #define REG_BYTES_PER_IRQ_WORD (sizeof(u32) * 4) @@ -127,7 +124,7 @@ static void bcm7038_l1_irq_handle(struct irq_desc *desc) struct irq_chip *chip = irq_desc_get_chip(desc); unsigned int idx; -#ifdef CONFIG_SMP +#if defined(CONFIG_SMP) && defined(CONFIG_MIPS) cpu = intc->cpus[cpu_logical_map(smp_processor_id())]; #else cpu = intc->cpus[0]; @@ -301,7 +298,7 @@ static int bcm7038_l1_suspend(void) u32 val; /* Wakeup interrupt should only come from the boot cpu */ -#ifdef CONFIG_SMP +#if defined(CONFIG_SMP) && defined(CONFIG_MIPS) boot_cpu = cpu_logical_map(0); #else boot_cpu = 0; @@ -325,7 +322,7 @@ static void bcm7038_l1_resume(void) struct bcm7038_l1_chip *intc; int boot_cpu, word; -#ifdef CONFIG_SMP +#if defined(CONFIG_SMP) && defined(CONFIG_MIPS) boot_cpu = cpu_logical_map(0); #else boot_cpu = 0; -- 2.25.1
Powered by blists - more mailing lists