linuxppc-dev.lists.ozlabs.org archive mirror
 help / color / mirror / Atom feed
From: "Ian Munsie" <imunsie@au1.ibm.com>
To: Anton Blanchard <anton@samba.org>
Cc: "sonal.santan" <sonal.santan@xilinx.com>,
	linuxppc-dev <linuxppc-dev@ozlabs.org>,
	Samuel Mendoza-Jonas <sam.mj@au1.ibm.com>,
	Jeremy Kerr <jk@ozlabs.org>,
	Michael Neuling <michael.neuling@au1.ibm.com>,
	Ian Munsie <imunsie@au1.ibm.com>
Subject: [PATCH] Fix crash due to processing "memory-controller" nodes as "memory"
Date: Mon, 20 Jul 2015 18:20:50 +1000	[thread overview]
Message-ID: <1437380450-25555-1-git-send-email-imunsie@au.ibm.com> (raw)

From: Ian Munsie <imunsie@au1.ibm.com>

If the system has a PCI device with a memory-controller device node,
kexec-lite would spew hundreds of double free warnings and eventually
segfault. This would result in a "kexec load failed" message from
petitboot.

This was due to kexec_memory_map() searching for "memory" nodes, but
actually matching any node that started with "memory", including these
"memory-controller" nodes. This patch changes the search to look for
nodes starting with "memory@", which should only match memory nodes.

An example of a device tree that can trigger this bug is as follows:

{
	pciex@3fffe40000000 {
		...
		pci@0 {
			#address-cells = <0x3>;
			#size-cells = <0x2>;
			...
			memory-controller@0 {
				reg = <0x10000 0x0 0x0 0x0 0x0>;
				...
			};
		};
	};
};

Signed-off-by: Ian Munsie <imunsie@au1.ibm.com>
---
 kexec_memory_map.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kexec_memory_map.c b/kexec_memory_map.c
index fc1b7af..7f18de7 100644
--- a/kexec_memory_map.c
+++ b/kexec_memory_map.c
@@ -192,7 +192,7 @@ void kexec_memory_map(void *fdt, int reserve_initrd)
 
 		name = fdt_get_name(fdt, nodeoffset, NULL);
 
-		if (!name || strncmp(name, "memory", strlen("memory")))
+		if (!name || strncmp(name, "memory@", strlen("memory@")))
 			continue;
 
 		reg = fdt_getprop(fdt, nodeoffset, "reg", &len);
-- 
2.1.4

             reply	other threads:[~2015-07-20  8:22 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-07-20  8:20 Ian Munsie [this message]
2015-07-20  8:25 ` [PATCH] Fix crash due to processing "memory-controller" nodes as "memory" Ian Munsie
2015-07-21  2:45 ` Anton Blanchard
2015-07-21  2:54   ` Benjamin Herrenschmidt
2015-07-21  3:06   ` Michael Ellerman
2015-07-21 23:18     ` Anton Blanchard
2015-07-22  0:36       ` Ian Munsie
2015-07-22  5:15         ` Anton Blanchard
2015-07-22  0:39       ` Jeremy Kerr
2015-07-22  1:32         ` Michael Neuling

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1437380450-25555-1-git-send-email-imunsie@au.ibm.com \
    --to=imunsie@au1.ibm.com \
    --cc=anton@samba.org \
    --cc=jk@ozlabs.org \
    --cc=linuxppc-dev@ozlabs.org \
    --cc=michael.neuling@au1.ibm.com \
    --cc=sam.mj@au1.ibm.com \
    --cc=sonal.santan@xilinx.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).