Commit 135ef954 authored by Alexey Kardashevskiy's avatar Alexey Kardashevskiy Committed by Michael Ellerman

powerpc/powernv/npu: Check mmio_atsd array bounds when populating

A broken device tree might contain more than 8 values and introduce hard
to debug memory corruption bug. This adds the boundary check.
Signed-off-by: default avatarAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent 1b785611
...@@ -1178,8 +1178,9 @@ int pnv_npu2_init(struct pci_controller *hose) ...@@ -1178,8 +1178,9 @@ int pnv_npu2_init(struct pci_controller *hose)
npu->nmmu_flush = of_property_read_bool(hose->dn, "ibm,nmmu-flush"); npu->nmmu_flush = of_property_read_bool(hose->dn, "ibm,nmmu-flush");
for (i = 0; !of_property_read_u64_index(hose->dn, "ibm,mmio-atsd", for (i = 0; i < ARRAY_SIZE(npu->mmio_atsd_regs) &&
i, &mmio_atsd); i++) !of_property_read_u64_index(hose->dn, "ibm,mmio-atsd",
i, &mmio_atsd); i++)
npu->mmio_atsd_regs[i] = ioremap(mmio_atsd, 32); npu->mmio_atsd_regs[i] = ioremap(mmio_atsd, 32);
pr_info("NPU%d: Found %d MMIO ATSD registers", hose->global_number, i); pr_info("NPU%d: Found %d MMIO ATSD registers", hose->global_number, i);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment