averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

MIPS: mm: Fix out-of-bounds write in maar_res_walk()

Browse Source 
[ Upstream commit 1b001b16bc ]

maar_res_walk() uses wi->num_cfg as the index into the fixed-size
wi->cfg array, but checks whether the array is full only after it has
filled the selected entry. If walk_system_ram_range() reports more than
16 memory ranges, the overflow call writes one struct maar_config past
the end of the array before WARN_ON() prevents num_cfg from advancing.

Move the full-array check before taking the array slot and return non-zero
when the scratch array is full, so walk_system_ram_range() terminates the
walk instead of invoking the callback for further ranges.

Fixes: a5718fe8f7 ("MIPS: mm: Drop boot_mem_map")

Signed-off-by: Yadan Fan <ydfan@suse.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Yadan Fan
2026-07-24 16:03:13 +02:00
committed by Greg Kroah-Hartman
parent c05a0ec1cd
commit ac7385af1d
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
arch/mips/mm/init.c
+8 -4
View File
@@ -281,9 +281,15 @@ static int maar_res_walk(unsigned long start_pfn, unsigned long nr_pages,
void *data)
{
struct maar_walk_info *wi = data;
struct maar_config *cfg = &wi->cfg[wi->num_cfg];
struct maar_config *cfg;
unsigned int maar_align;
/* Ensure we don't overflow the cfg array */
if (WARN_ON(wi->num_cfg >= ARRAY_SIZE(wi->cfg)))
return -1;
cfg = &wi->cfg[wi->num_cfg];
/* MAAR registers hold physical addresses right shifted by 4 bits */
maar_align = BIT(MIPS_MAAR_ADDR_SHIFT + 4);
@@ -292,9 +298,7 @@ static int maar_res_walk(unsigned long start_pfn, unsigned long nr_pages,
cfg->upper = ALIGN_DOWN(PFN_PHYS(start_pfn + nr_pages), maar_align) - 1;
cfg->attrs = MIPS_MAAR_S;
/* Ensure we don't overflow the cfg array */
if (!WARN_ON(wi->num_cfg >= ARRAY_SIZE(wi->cfg)))
wi->num_cfg++;
wi->num_cfg++;
return 0;
}