korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-16 16:54:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

[POWERPC] bootwrapper: Fix array handling in dt_xlate_reg().

Browse Source 
This fixes a few bugs in how dt_xlate_reg() handles address arrays:

1. copy_val() was copying into the wrong end of the array, resulting
in random stack garbage at the other end.
2. dt_xlate_reg() was getting the result from the wrong end of the array.
3. add_reg() and sub_reg() were treating the arrays as
little-endian rather than big-endian.
4. add_reg() only returned an error on a carry out of the entire
array, rather than out of the naddr portion.
5. The requested reg resource was checked to see if it exceeded
the size of the reg property, but not to see if it exceeded the
size of the buffer.

Signed-off-by: Scott Wood <scottwood@freescale.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
This commit is contained in:
Scott Wood 2007-04-27 03:08:13 +10:00 committed by Paul Mackerras
parent 3c5f616254
commit e4bb688d9f
1 changed files with 11 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
arch/powerpc/boot/devtree.c
View File

@ -123,15 +123,17 @@ static void get_reg_format(void *node, u32 *naddr, u32 *nsize)
static void copy_val(u32 *dest, u32 *src, int naddr)
{
memset(dest, 0, (MAX_ADDR_CELLS - naddr) * 4);
memcpy(dest, src, naddr * 4);
int pad = MAX_ADDR_CELLS - naddr;
memset(dest, 0, pad * 4);
memcpy(dest + pad, src, naddr * 4);
}
static int sub_reg(u32 *reg, u32 *sub)
{
int i, borrow = 0;
for (i = 0; i < MAX_ADDR_CELLS; i++) {
for (i = MAX_ADDR_CELLS - 1; i >= 0; i--) {
int prev_borrow = borrow;
borrow = reg[i] < sub[i] + prev_borrow;
reg[i] -= sub[i] + prev_borrow;
@ -140,11 +142,11 @@ static int sub_reg(u32 *reg, u32 *sub)
return !borrow;
}
static int add_reg(u32 *reg, u32 *add)
static int add_reg(u32 *reg, u32 *add, int naddr)
{
int i, carry = 0;
for (i = 0; i < MAX_ADDR_CELLS; i++) {
for (i = MAX_ADDR_CELLS - 1; i >= MAX_ADDR_CELLS - naddr; i--) {
u64 tmp = (u64)reg[i] + add[i] + carry;
carry = tmp >> 32;
reg[i] = (u32)tmp;
@ -228,7 +230,8 @@ int dt_xlate_reg(void *node, int res, unsigned long *addr,
buflen = getprop(node, "reg", buf, sizeof(buf)) / 4;
offset = (naddr + nsize) * res;
if (buflen < offset + naddr + nsize)
if (buflen < offset + naddr + nsize ||
sizeof(buf) < offset + naddr + nsize)
return 0;
copy_val(last_addr, buf + offset, naddr);
@ -263,18 +266,14 @@ int dt_xlate_reg(void *node, int res, unsigned long *addr,
copy_val(this_addr, buf + offset + prev_naddr, naddr);
if (!add_reg(last_addr, this_addr))
if (!add_reg(last_addr, this_addr, naddr))
return 0;
}
if (naddr > 2)
return 0;
ret_addr = last_addr[0];
if (naddr == 2) {
ret_addr <<= 32;
ret_addr |= last_addr[1];
}
ret_addr = ((u64)last_addr[2] << 32) | last_addr[3];
if (sizeof(void *) == 4 &&
(ret_addr >= 0x100000000ULL || ret_size > 0x100000000ULL ||