Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756095Ab3JGMDL (ORCPT ); Mon, 7 Oct 2013 08:03:11 -0400 Received: from mail-wi0-f174.google.com ([209.85.212.174]:60619 "EHLO mail-wi0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754691Ab3JGMCu (ORCPT ); Mon, 7 Oct 2013 08:02:50 -0400 From: Grant Likely To: devicetree@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Grant Likely , Rob Herring , Benjamin Herrenschmidt Subject: [PATCH] of: fix iteration bug over CPU reg properties Date: Fri, 4 Oct 2013 17:40:02 +0100 Message-Id: <1380904802-10432-1-git-send-email-grant.likely@linaro.org> X-Mailer: git-send-email 1.8.1.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1727 Lines: 45 The size of each hwid in a cpu nodes 'reg' property is defined by the parents #address-cells property in the normal way. The cpu parsing code has a bug where it will overrun the end of the property if address-cells is greater than one. This commit fixes the problem by adjusting the array size by the number of address cells. It also makes sure address-cells isn't zero for that would cause an infinite loop. Signed-off-by: Grant Likely Cc: Rob Herring Cc: Benjamin Herrenschmidt --- I discovered this during code inspection. I don't think it is an actual bug seen in the wild, but the code does look wrong. I'd appreciate someone take a look and confirm that I've read the code right. drivers/of/base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/of/base.c b/drivers/of/base.c index e4c9945..470b871 100644 --- a/drivers/of/base.c +++ b/drivers/of/base.c @@ -263,11 +263,11 @@ static bool __of_find_n_match_cpu_property(struct device_node *cpun, int ac, prop_len, tid; u64 hwid; - ac = of_n_addr_cells(cpun); + ac = of_n_addr_cells(cpun) ? : OF_ROOT_NODE_ADDR_CELLS_DEFAULT; cell = of_get_property(cpun, prop_name, &prop_len); if (!cell) return false; - prop_len /= sizeof(*cell); + prop_len /= sizeof(*cell) * ac; for (tid = 0; tid < prop_len; tid++) { hwid = of_read_number(cell, ac); if (arch_match_cpu_phys_id(cpu, hwid)) { -- 1.8.1.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/