From patchwork Wed Feb 20 11:52:55 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Enrico Scholz X-Patchwork-Id: 2167301 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) by patchwork1.kernel.org (Postfix) with ESMTP id ED9523FD4E for ; Wed, 20 Feb 2013 11:56:53 +0000 (UTC) Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.76 #1 (Red Hat Linux)) id 1U88Fn-0003xb-3X; Wed, 20 Feb 2013 11:54:27 +0000 Received: from mail.cvg.de ([62.153.82.30]) by merlin.infradead.org with esmtps (Exim 4.76 #1 (Red Hat Linux)) id 1U88Fj-0003tN-4O for linux-arm-kernel@lists.infradead.org; Wed, 20 Feb 2013 11:54:24 +0000 Received: from ensc-virt.intern.sigma-chemnitz.de (ensc-virt.intern.sigma-chemnitz.de [192.168.3.24]) by mail.cvg.de (8.14.4/8.14.4) with ESMTP id r1KBrRBf017046 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 20 Feb 2013 12:53:29 +0100 Received: from ensc by ensc-virt.intern.sigma-chemnitz.de with local (Exim 4.76) (envelope-from ) id 1U88Ep-0006ve-Jd; Wed, 20 Feb 2013 12:53:27 +0100 From: Enrico Scholz To: linux-arm-kernel@lists.infradead.org Subject: [PATCH] ARM: poison_init_mem: fixed underflow in loop Date: Wed, 20 Feb 2013 12:52:55 +0100 Message-Id: <1361361175-26600-1-git-send-email-enrico.scholz@sigma-chemnitz.de> X-Mailer: git-send-email 1.8.1.2 X-DSPAM-Result: Innocent X-DSPAM-Probability: 0 X-DSPAM-Confidence: 1 X-Spam-Score: -5.6 X-Spam-Level: ----- X-Spam-Tests: AWL,BAYES_00,RP_MATCHES_RCVD,SPF_NEUTRAL,DSPAM_INNOCENT X-Scanned-By: MIMEDefang 2.73 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20130220_065423_471010_CE02B274 X-CRM114-Status: UNSURE ( 9.82 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -4.2 (----) X-Spam-Report: SpamAssassin version 3.3.2 on merlin.infradead.org summary: Content analysis details: (-4.2 points) pts rule name description ---- ---------------------- -------------------------------------------------- -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/, medium trust [62.153.82.30 listed in list.dnswl.org] -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] Cc: Enrico Scholz , Russell King X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: linux-arm-kernel-bounces@lists.infradead.org Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org When initmemory ends at an odd address, the loop variable in poison_init_mem() will underflow which causes overriding of valid memory. Such situations are not a theoretical issue only but exist in practice: | [ 0.000000] .init : 0xc0634000 - 0xc0c215ab (6070 kB) Patch makes a simple division instead of DIV_ROUND_UP() because latter can override some bytes after .init. Signed-off-by: Enrico Scholz --- arch/arm/mm/init.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c index ad722f1..c431a2d 100644 --- a/arch/arm/mm/init.c +++ b/arch/arm/mm/init.c @@ -449,7 +449,8 @@ static inline int free_area(unsigned long pfn, unsigned long end, char *s) static inline void poison_init_mem(void *s, size_t count) { u32 *p = (u32 *)s; - for (; count != 0; count -= 4) + count /= sizeof(*p); + for (; count != 0; count--) *p++ = 0xe7fddef0; }