From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ozlabs.org (ozlabs.org [IPv6:2401:3900:2:1::2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id CB2B21A02B5 for ; Mon, 20 Jul 2015 18:22:16 +1000 (AEST) Received: from e23smtp06.au.ibm.com (e23smtp06.au.ibm.com [202.81.31.148]) (using TLSv1 with cipher CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 90F5D14076B for ; Mon, 20 Jul 2015 18:22:16 +1000 (AEST) Received: from /spool/local by e23smtp06.au.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 20 Jul 2015 18:22:15 +1000 From: "Ian Munsie" To: Anton Blanchard Cc: "sonal.santan" , linuxppc-dev , Samuel Mendoza-Jonas , Jeremy Kerr , Michael Neuling , Ian Munsie Subject: [PATCH] Fix crash due to processing "memory-controller" nodes as "memory" Date: Mon, 20 Jul 2015 18:20:50 +1000 Message-Id: <1437380450-25555-1-git-send-email-imunsie@au.ibm.com> List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Ian Munsie If the system has a PCI device with a memory-controller device node, kexec-lite would spew hundreds of double free warnings and eventually segfault. This would result in a "kexec load failed" message from petitboot. This was due to kexec_memory_map() searching for "memory" nodes, but actually matching any node that started with "memory", including these "memory-controller" nodes. This patch changes the search to look for nodes starting with "memory@", which should only match memory nodes. An example of a device tree that can trigger this bug is as follows: { pciex@3fffe40000000 { ... pci@0 { #address-cells = <0x3>; #size-cells = <0x2>; ... memory-controller@0 { reg = <0x10000 0x0 0x0 0x0 0x0>; ... }; }; }; }; Signed-off-by: Ian Munsie --- kexec_memory_map.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kexec_memory_map.c b/kexec_memory_map.c index fc1b7af..7f18de7 100644 --- a/kexec_memory_map.c +++ b/kexec_memory_map.c @@ -192,7 +192,7 @@ void kexec_memory_map(void *fdt, int reserve_initrd) name = fdt_get_name(fdt, nodeoffset, NULL); - if (!name || strncmp(name, "memory", strlen("memory"))) + if (!name || strncmp(name, "memory@", strlen("memory@"))) continue; reg = fdt_getprop(fdt, nodeoffset, "reg", &len); -- 2.1.4