diff options
| author | zbb <zbb@FreeBSD.org> | 2017-05-25 14:16:43 +0000 |
|---|---|---|
| committer | Luiz Souza <luiz@netgate.com> | 2017-09-06 11:36:15 -0500 |
| commit | 0d97d07d027447555b10af0512e5cda8d2aec307 (patch) | |
| tree | 783fd8aca0566dbdcdcd60713a902c55c1790b1e /sys/arm/mv | |
| parent | d730a018c48bef442ca0a4339991030e73da6073 (diff) | |
| download | FreeBSD-src-0d97d07d027447555b10af0512e5cda8d2aec307.zip FreeBSD-src-0d97d07d027447555b10af0512e5cda8d2aec307.tar.gz | |
Fix memory corruption while configuring CPU windows on Marvell SoCs
Resolving CPU windows from localbus entry caused buffer overflow
and memory corruption. Fix wrong indexing and ensure the index
does not exceed table size.
Submitted by: Wojciech Macek <wma@semihalf.com>
Obtained from: Semihalf
Sponsored by: Stormshield
Differential revision: https://reviews.freebsd.org/D10720
(cherry picked from commit 2b25a3b2c3f4ee5c25038fd9e98e03fa04b8886e)
Diffstat (limited to 'sys/arm/mv')
| -rw-r--r-- | sys/arm/mv/mv_common.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/sys/arm/mv/mv_common.c b/sys/arm/mv/mv_common.c index b4deb60..c2511d7 100644 --- a/sys/arm/mv/mv_common.c +++ b/sys/arm/mv/mv_common.c @@ -2279,6 +2279,12 @@ win_cpu_from_dt(void) entry_size = tuple_size / sizeof(pcell_t); cpu_wins_no = tuples; + /* Check range */ + if (tuples > nitems(cpu_win_tbl)) { + debugf("too many tuples to fit into cpu_win_tbl\n"); + return (ENOMEM); + } + for (i = 0, t = 0; t < tuples; i += entry_size, t++) { cpu_win_tbl[t].target = 1; cpu_win_tbl[t].attr = fdt32_to_cpu(ranges[i + 1]); @@ -2311,6 +2317,12 @@ moveon: if (fdt_regsize(node, &sram_base, &sram_size) != 0) return (EINVAL); + /* Check range */ + if (t >= nitems(cpu_win_tbl)) { + debugf("cannot fit CESA tuple into cpu_win_tbl\n"); + return (ENOMEM); + } + cpu_win_tbl[t].target = MV_WIN_CESA_TARGET; #ifdef SOC_MV_ARMADA38X cpu_win_tbl[t].attr = MV_WIN_CESA_ATTR(0); |
