• Steven Rostedt's avatar
    PCI hotplug: ibmphp: Add check to prevent reading beyond mapped area · ac3abf2c
    Steven Rostedt authored
    While testing various randconfigs with ktest.pl, I hit the following panic:
    
    BUG: unable to handle kernel paging request at f7e54b03
    IP: [<c0d63409>] ibmphp_access_ebda+0x101/0x19bb
    
    Adding printks, I found that the loop that reads the ebda blocks
    can move out of the mapped section.
    
    ibmphp_access_ebda: start=f7e44c00 size=5120 end=f7e46000
    ibmphp_access_ebda: io_mem=f7e44d80 offset=384
    ibmphp_access_ebda: io_mem=f7e54b03 offset=65283
    
    The start of the iomap was at f7e44c00 and had a size of 5120,
    making the end f7e46000. We start with an offset of 0x180 or
    384, giving the first read at 0xf7e44d80. Reading that location
    yields 65283, which is much bigger than the 5120 that was allocated
    and makes the next read at f7e54b03 which is outside the mapped area.
    
    Perhaps this is a bug in the driver, or buggy hardware, but this patch
    is more about not crashing my box on start up and just giving a warning
    if it detects this error.
    
    This patch at least lets my box boot with just a warning.
    
    Cc: Chandru Siddalingappa <chandru@linux.vnet.ibm.com>
    Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
    Signed-off-by: default avatarJesse Barnes <jbarnes@virtuousgeek.org>
    ac3abf2c
ibmphp_ebda.c 34.7 KB