[PATCH v2 1/2] MIPS: cavium-octeon: fix out-of-bounds array access

[PATCH v2 1/2] MIPS: cavium-octeon: fix out-of-bounds array access

[Aaro Koskinen]

When booting with in-kernel DTBs, the pruning code will enumerate
interfaces 0-4. However, there is memory reserved only for 4 so some
other data will get overwritten by cvmx_helper_interface_enumerate().

Signed-off-by: Aaro Koskinen <aaro.koskinen@nsn.com>
---

	v2: a new patch in the series

 arch/mips/cavium-octeon/executive/cvmx-helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/cavium-octeon/executive/cvmx-helper.c b/arch/mips/cavium-octeon/executive/cvmx-helper.c
index d63d20d..0e4b340 100644
--- a/arch/mips/cavium-octeon/executive/cvmx-helper.c
+++ b/arch/mips/cavium-octeon/executive/cvmx-helper.c
@@ -67,7 +67,7 @@ void (*cvmx_override_pko_queue_priority) (int pko_port,
 void (*cvmx_override_ipd_port_setup) (int ipd_port);
 
 /* Port count per interface */
-static int interface_port_count[4] = { 0, 0, 0, 0 };
+static int interface_port_count[5];
 
 /* Port last configured link info index by IPD/PKO port */
 static cvmx_helper_link_info_t
-- 
1.8.4.rc3

[PATCH v2 2/2] MIPS: cavium-octeon: fix early boot hang on EBH5600 board

[Aaro Koskinen]

The boot hangs early on EBH5600 board when octeon_fdt_pip_iface() is
trying enumerate a non-existant interface. The actual hang happens in
cvmx_helper_interface_get_mode():

	mode.u64 = cvmx_read_csr(CVMX_GMXX_INF_MODE(interface));

when interface == 4. We can avoid this situation by first checking that
the interface exists in the DTB.

Signed-off-by: Aaro Koskinen <aaro.koskinen@nsn.com>
---

	v2: Provide more detailed problem description.

 arch/mips/cavium-octeon/octeon-platform.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c
index 1830874..f68c75a 100644
--- a/arch/mips/cavium-octeon/octeon-platform.c
+++ b/arch/mips/cavium-octeon/octeon-platform.c
@@ -336,14 +336,14 @@ static void __init octeon_fdt_pip_iface(int pip, int idx, u64 *pmac)
 	int p;
 	int count = 0;
 
-	if (cvmx_helper_interface_enumerate(idx) == 0)
-		count = cvmx_helper_ports_on_interface(idx);
-
 	snprintf(name_buffer, sizeof(name_buffer), "interface@%d", idx);
 	iface = fdt_subnode_offset(initial_boot_params, pip, name_buffer);
 	if (iface < 0)
 		return;
 
+	if (cvmx_helper_interface_enumerate(idx) == 0)
+		count = cvmx_helper_ports_on_interface(idx);
+
 	for (p = 0; p < 16; p++)
 		octeon_fdt_pip_port(iface, idx, p, count - 1, pmac);
 }
-- 
1.8.4.rc3

Re: [PATCH v2 1/2] MIPS: cavium-octeon: fix out-of-bounds array access

[David Daney]

On 11/01/2013 08:06 AM, Aaro Koskinen wrote:
> When booting with in-kernel DTBs, the pruning code will enumerate
> interfaces 0-4. However, there is memory reserved only for 4 so some
> other data will get overwritten by cvmx_helper_interface_enumerate().
>
> Signed-off-by: Aaro Koskinen <aaro.koskinen@nsn.com>

Thanks for finding this,  tested and ...

Acked-by: David Daney <david.daney@cavium.com>


Ralf:  Please apply.

Aaro: Suggest stable branches that this is a candidate for.

> ---
>
> 	v2: a new patch in the series
>
>   arch/mips/cavium-octeon/executive/cvmx-helper.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/mips/cavium-octeon/executive/cvmx-helper.c b/arch/mips/cavium-octeon/executive/cvmx-helper.c
> index d63d20d..0e4b340 100644
> --- a/arch/mips/cavium-octeon/executive/cvmx-helper.c
> +++ b/arch/mips/cavium-octeon/executive/cvmx-helper.c
> @@ -67,7 +67,7 @@ void (*cvmx_override_pko_queue_priority) (int pko_port,
>   void (*cvmx_override_ipd_port_setup) (int ipd_port);
>
>   /* Port count per interface */
> -static int interface_port_count[4] = { 0, 0, 0, 0 };
> +static int interface_port_count[5];
>
>   /* Port last configured link info index by IPD/PKO port */
>   static cvmx_helper_link_info_t
>

Re: [PATCH v2 2/2] MIPS: cavium-octeon: fix early boot hang on EBH5600 board

[David Daney]

On 11/01/2013 08:06 AM, Aaro Koskinen wrote:
> The boot hangs early on EBH5600 board when octeon_fdt_pip_iface() is
> trying enumerate a non-existant interface. The actual hang happens in
> cvmx_helper_interface_get_mode():
>
> 	mode.u64 = cvmx_read_csr(CVMX_GMXX_INF_MODE(interface));
>
> when interface == 4. We can avoid this situation by first checking that
> the interface exists in the DTB.
>
> Signed-off-by: Aaro Koskinen <aaro.koskinen@nsn.com>

Thanks for finding this,  tested and ...

Acked-by: David Daney <david.daney@cavium.com>


Ralf:  Please apply.

Aaro: Suggest stable branches that this is a candidate for.


> ---
>
> 	v2: Provide more detailed problem description.
>
>   arch/mips/cavium-octeon/octeon-platform.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c
> index 1830874..f68c75a 100644
> --- a/arch/mips/cavium-octeon/octeon-platform.c
> +++ b/arch/mips/cavium-octeon/octeon-platform.c
> @@ -336,14 +336,14 @@ static void __init octeon_fdt_pip_iface(int pip, int idx, u64 *pmac)
>   	int p;
>   	int count = 0;
>
> -	if (cvmx_helper_interface_enumerate(idx) == 0)
> -		count = cvmx_helper_ports_on_interface(idx);
> -
>   	snprintf(name_buffer, sizeof(name_buffer), "interface@%d", idx);
>   	iface = fdt_subnode_offset(initial_boot_params, pip, name_buffer);
>   	if (iface < 0)
>   		return;
>
> +	if (cvmx_helper_interface_enumerate(idx) == 0)
> +		count = cvmx_helper_ports_on_interface(idx);
> +
>   	for (p = 0; p < 16; p++)
>   		octeon_fdt_pip_port(iface, idx, p, count - 1, pmac);
>   }
>

Re: [PATCH v2 1/2] MIPS: cavium-octeon: fix out-of-bounds array access

[Aaro Koskinen]

Hi,

On Fri, Nov 08, 2013 at 01:45:05PM -0800, David Daney wrote:
> On 11/01/2013 08:06 AM, Aaro Koskinen wrote:
> >When booting with in-kernel DTBs, the pruning code will enumerate
> >interfaces 0-4. However, there is memory reserved only for 4 so some
> >other data will get overwritten by cvmx_helper_interface_enumerate().
> >
> >Signed-off-by: Aaro Koskinen <aaro.koskinen@nsn.com>
> 
> Thanks for finding this,  tested and ...
> 
> Acked-by: David Daney <david.daney@cavium.com>
> 
> 
> Ralf:  Please apply.
> 
> Aaro: Suggest stable branches that this is a candidate for.

These are relevant for >= 3.10 stable kernels.

A.