github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

MIPS: mm: Fix out-of-bounds write in maar_res_walk()

Browse Source 
maar_res_walk() uses wi->num_cfg as the index into the fixed-size
wi->cfg array, but checks whether the array is full only after it has
filled the selected entry. If walk_system_ram_range() reports more than
16 memory ranges, the overflow call writes one struct maar_config past
the end of the array before WARN_ON() prevents num_cfg from advancing.

Move the full-array check before taking the array slot and return non-zero
when the scratch array is full, so walk_system_ram_range() terminates the
walk instead of invoking the callback for further ranges.

Fixes: a5718fe8f7 ("MIPS: mm: Drop boot_mem_map")

Signed-off-by: Yadan Fan <ydfan@suse.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
This commit is contained in:
Yadan Fan 2026-05-25 12:04:36 +08:00 committed by Thomas Bogendoerfer
parent aeaa898780
commit 1b001b16bc
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
arch/mips/mm/init.c
View File

@ -272,9 +272,15 @@ static int maar_res_walk(unsigned long start_pfn, unsigned long nr_pages,
void *data)
{
struct maar_walk_info *wi = data;
struct maar_config *cfg = &wi->cfg[wi->num_cfg];
struct maar_config *cfg;
unsigned int maar_align;
/* Ensure we don't overflow the cfg array */
if (WARN_ON(wi->num_cfg >= ARRAY_SIZE(wi->cfg)))
return -1;
cfg = &wi->cfg[wi->num_cfg];
/* MAAR registers hold physical addresses right shifted by 4 bits */
maar_align = BIT(MIPS_MAAR_ADDR_SHIFT + 4);
@ -283,9 +289,7 @@ static int maar_res_walk(unsigned long start_pfn, unsigned long nr_pages,
cfg->upper = ALIGN_DOWN(PFN_PHYS(start_pfn + nr_pages), maar_align) - 1;
cfg->attrs = MIPS_MAAR_S;
/* Ensure we don't overflow the cfg array */
if (!WARN_ON(wi->num_cfg >= ARRAY_SIZE(wi->cfg)))
wi->num_cfg++;
wi->num_cfg++;
return 0;
}