]>
Commit | Line | Data |
---|---|---|
47bcbf55 MG |
1 | |
2 | Delivered-To: eric.y.miao@gmail.com | |
3 | Received: by 10.229.89.5 with SMTP id c5cs439662qcm; | |
4 | Fri, 18 Dec 2009 19:48:56 -0800 (PST) | |
5 | Received: by 10.220.122.229 with SMTP id m37mr3710050vcr.75.1261194536337; | |
6 | Fri, 18 Dec 2009 19:48:56 -0800 (PST) | |
7 | Return-Path: <linux-arm-kernel-bounces+eric.y.miao=gmail.com@lists.infradead.org> | |
8 | Received: from bombadil.infradead.org (bombadil.infradead.org [18.85.46.34]) | |
9 | by mx.google.com with ESMTP id 15si5178130vws.113.2009.12.18.19.48.55; | |
10 | Fri, 18 Dec 2009 19:48:56 -0800 (PST) | |
11 | Received-SPF: neutral (google.com: 18.85.46.34 is neither permitted nor denied by domain of linux-arm-kernel-bounces+eric.y.miao=gmail.com@lists.infradead.org) client-ip=18.85.46.34; | |
12 | Authentication-Results: mx.google.com; spf=neutral (google.com: 18.85.46.34 is neither permitted nor denied by domain of linux-arm-kernel-bounces+eric.y.miao=gmail.com@lists.infradead.org) smtp.mail=linux-arm-kernel-bounces+eric.y.miao=gmail.com@lists.infradead.org | |
13 | Received: from localhost ([::1] helo=bombadil.infradead.org) | |
14 | by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux)) | |
15 | id 1NLqHA-0005fo-Vx; Sat, 19 Dec 2009 03:46:40 +0000 | |
16 | Received: from mho-01-ewr.mailhop.org ([204.13.248.71]) | |
17 | by bombadil.infradead.org with esmtps (Exim 4.69 #1 (Red Hat Linux)) | |
18 | id 1NLqH4-0005fB-Se for linux-arm-kernel@lists.infradead.org; | |
19 | Sat, 19 Dec 2009 03:46:39 +0000 | |
20 | Received: from c-67-160-239-110.hsd1.ca.comcast.net ([67.160.239.110] | |
21 | helo=[127.0.0.1]) by mho-01-ewr.mailhop.org with esmtpa (Exim 4.68) | |
22 | (envelope-from <tony@atomide.com>) | |
23 | id 1NLqH4-000HuN-CC; Sat, 19 Dec 2009 03:46:34 +0000 | |
24 | X-Mail-Handler: MailHop Outbound by DynDNS | |
25 | X-Originating-IP: 67.160.239.110 | |
26 | X-Report-Abuse-To: abuse@dyndns.com (see | |
27 | http://www.dyndns.com/services/mailhop/outbound_abuse.html for | |
28 | abuse reporting information) | |
29 | X-MHO-User: U2FsdGVkX1+sI1hhEpkgqBCPoi5GTu+G | |
30 | Subject: [PATCH 4/5] arm: Fix init_atags_procfs() to check tag->hdr.size | |
31 | To: linux-arm-kernel@lists.infradead.org | |
32 | From: Tony Lindgren <tony@atomide.com> | |
33 | Date: Fri, 18 Dec 2009 19:46:30 -0800 | |
34 | Message-ID: <20091219034630.26198.35713.stgit@localhost> | |
35 | In-Reply-To: <20091219034151.26198.26570.stgit@localhost> | |
36 | References: <20091219034151.26198.26570.stgit@localhost> | |
37 | User-Agent: StGit/0.15-6-gbbd0 | |
38 | MIME-Version: 1.0 | |
39 | X-CRM114-Version: 20090807-BlameThorstenAndJenny ( TRE 0.7.6 (BSD) ) | |
40 | MR-646709E3 | |
41 | X-CRM114-CacheID: sfid-20091218_224635_034795_3362075B | |
42 | X-CRM114-Status: GOOD ( 24.83 ) | |
43 | X-Spam-Score: 0.0 (/) | |
44 | X-Spam-Report: SpamAssassin version 3.2.5 on bombadil.infradead.org summary: | |
45 | Content analysis details: (0.0 points) | |
46 | pts rule name description | |
47 | ---- ---------------------- | |
48 | -------------------------------------------------- _SUMMARY_ | |
49 | Cc: linux-omap@vger.kernel.org | |
50 | X-BeenThere: linux-arm-kernel@lists.infradead.org | |
51 | X-Mailman-Version: 2.1.12 | |
52 | Precedence: list | |
53 | List-Id: <linux-arm-kernel.lists.infradead.org> | |
54 | List-Unsubscribe: <http://lists.infradead.org/mailman/options/linux-arm-kernel>, | |
55 | <mailto:linux-arm-kernel-request@lists.infradead.org?subject=unsubscribe> | |
56 | List-Archive: <http://lists.infradead.org/pipermail/linux-arm-kernel/> | |
57 | List-Post: <mailto:linux-arm-kernel@lists.infradead.org> | |
58 | List-Help: <mailto:linux-arm-kernel-request@lists.infradead.org?subject=help> | |
59 | List-Subscribe: <http://lists.infradead.org/mailman/listinfo/linux-arm-kernel>, | |
60 | <mailto:linux-arm-kernel-request@lists.infradead.org?subject=subscribe> | |
61 | Content-Type: text/plain; charset="us-ascii" | |
62 | Content-Transfer-Encoding: 7bit | |
63 | Sender: linux-arm-kernel-bounces@lists.infradead.org | |
64 | Errors-To: linux-arm-kernel-bounces+eric.y.miao=gmail.com@lists.infradead.org | |
65 | ||
66 | The tag->hdr.size cannot be larger than XXX. | |
67 | Otherwise we can getsomething similar during boot: | |
68 | ||
69 | Unable to handle kernel paging request at virtual address 61a05020 | |
70 | ... | |
71 | ||
72 | Signed-off-by: Tony Lindgren <tony@atomide.com> | |
73 | --- | |
74 | arch/arm/include/asm/setup.h | 12 +++++++++--- | |
75 | arch/arm/kernel/atags.c | 2 +- | |
76 | arch/arm/kernel/compat.c | 2 +- | |
77 | arch/arm/kernel/setup.c | 4 ++-- | |
78 | arch/arm/mach-orion5x/common.c | 2 +- | |
79 | 5 files changed, 14 insertions(+), 8 deletions(-) | |
80 | ||
81 | diff --git a/arch/arm/include/asm/setup.h b/arch/arm/include/asm/setup.h | |
82 | index 5ccce0a..3ca36bb 100644 | |
83 | --- a/arch/arm/include/asm/setup.h | |
84 | +++ b/arch/arm/include/asm/setup.h | |
85 | @@ -21,6 +21,11 @@ | |
86 | /* The list ends with an ATAG_NONE node. */ | |
87 | #define ATAG_NONE 0x00000000 | |
88 | ||
89 | +/* Some sanity checks are needed */ | |
90 | +#define ATAG_MAX_SZ PAGE_SIZE | |
91 | +#define atag_valid(tag) \ | |
92 | + ((tag)->hdr.size && ((tag)->hdr.size <= ATAG_MAX_SZ)) | |
93 | + | |
94 | struct tag_header { | |
95 | __u32 size; | |
96 | __u32 tag; | |
97 | @@ -173,9 +178,10 @@ struct tagtable { | |
98 | int (*parse)(const struct tag *); | |
99 | }; | |
100 | ||
101 | -#define tag_member_present(tag,member) \ | |
102 | - ((unsigned long)(&((struct tag *)0L)->member + 1) \ | |
103 | - <= (tag)->hdr.size * 4) | |
104 | +#define tag_member_present(tag,member) \ | |
105 | + (atag_valid(tag) && \ | |
106 | + (((unsigned long)(&((struct tag *)0L)->member + 1) \ | |
107 | + <= (tag)->hdr.size * 4)) | |
108 | ||
109 | #define tag_next(t) ((struct tag *)((__u32 *)(t) + (t)->hdr.size)) | |
110 | #define tag_size(type) ((sizeof(struct tag_header) + sizeof(struct type)) >> 2) | |
111 | diff --git a/arch/arm/kernel/atags.c b/arch/arm/kernel/atags.c | |
112 | index 42a1a14..14d0993 100644 | |
113 | --- a/arch/arm/kernel/atags.c | |
114 | +++ b/arch/arm/kernel/atags.c | |
115 | @@ -51,7 +51,7 @@ static int __init init_atags_procfs(void) | |
116 | return -EINVAL; | |
117 | } | |
118 | ||
119 | - for (; tag->hdr.size; tag = tag_next(tag)) | |
120 | + for (; atag_valid(tag); tag = tag_next(tag)) | |
121 | ; | |
122 | ||
123 | /* include the terminating ATAG_NONE */ | |
124 | diff --git a/arch/arm/kernel/compat.c b/arch/arm/kernel/compat.c | |
125 | index 0a13854..3e63ee1 100644 | |
126 | --- a/arch/arm/kernel/compat.c | |
127 | +++ b/arch/arm/kernel/compat.c | |
128 | @@ -220,7 +220,7 @@ void __init convert_to_tag_list(struct tag *tags) | |
129 | ||
130 | void __init squash_mem_tags(struct tag *tag) | |
131 | { | |
132 | - for (; tag->hdr.size; tag = tag_next(tag)) | |
133 | + for (; atag_valid(tag); tag = tag_next(tag)) | |
134 | if (tag->hdr.tag == ATAG_MEM) | |
135 | tag->hdr.tag = ATAG_NONE; | |
136 | } | |
137 | diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c | |
138 | index c6c57b6..53d7181 100644 | |
139 | --- a/arch/arm/kernel/setup.c | |
140 | +++ b/arch/arm/kernel/setup.c | |
141 | @@ -556,7 +556,7 @@ request_standard_resources(struct meminfo *mi, struct machine_desc *mdesc) | |
142 | */ | |
143 | static int __init parse_tag_core(const struct tag *tag) | |
144 | { | |
145 | - if (tag->hdr.size > 2) { | |
146 | + if ((atag_valid(tag) && (tag->hdr.size > 2))) { | |
147 | if ((tag->u.core.flags & 1) == 0) | |
148 | root_mountflags &= ~MS_RDONLY; | |
149 | ROOT_DEV = old_decode_dev(tag->u.core.rootdev); | |
150 | @@ -660,7 +660,7 @@ static int __init parse_tag(const struct tag *tag) | |
151 | */ | |
152 | static void __init parse_tags(const struct tag *t) | |
153 | { | |
154 | - for (; t->hdr.size; t = tag_next(t)) | |
155 | + for (; atag_valid(t); t = tag_next(t)) | |
156 | if (!parse_tag(t)) | |
157 | printk(KERN_WARNING | |
158 | "Ignoring unrecognised tag 0x%08x\n", | |
159 | diff --git a/arch/arm/mach-orion5x/common.c b/arch/arm/mach-orion5x/common.c | |
160 | index f87fa12..8afee34 100644 | |
161 | --- a/arch/arm/mach-orion5x/common.c | |
162 | +++ b/arch/arm/mach-orion5x/common.c | |
163 | @@ -717,7 +717,7 @@ void __init orion5x_init(void) | |
164 | void __init tag_fixup_mem32(struct machine_desc *mdesc, struct tag *t, | |
165 | char **from, struct meminfo *meminfo) | |
166 | { | |
167 | - for (; t->hdr.size; t = tag_next(t)) | |
168 | + for (; atag_valid(t); t = tag_next(t)) | |
169 | if (t->hdr.tag == ATAG_MEM && | |
170 | (!t->u.mem.size || t->u.mem.size & ~PAGE_MASK || | |
171 | t->u.mem.start & ~PAGE_MASK)) { | |
172 | ||
173 | ||
174 | _______________________________________________ | |
175 | linux-arm-kernel mailing list | |
176 | linux-arm-kernel@lists.infradead.org | |
177 | http://lists.infradead.org/mailman/listinfo/linux-arm-kernel |