[Top] [All Lists]

[PATCH] MIPS: msc: Prevent out-of-bounds writes to MIPS SC ioremap'd reg

To: <>
Subject: [PATCH] MIPS: msc: Prevent out-of-bounds writes to MIPS SC ioremap'd region
From: Markos Chandras <>
Date: Mon, 23 Jun 2014 09:48:51 +0100
Cc: Markos Chandras <>, <>
List-archive: <>
List-help: <>
List-id: linux-mips <>
List-owner: <>
List-post: <>
List-software: Ecartis version 1.0.0
List-subscribe: <>
List-unsubscribe: <>
Original-recipient: rfc822;
Previously, the lower limit for the MIPS SC initialization loop was
set incorrectly allowing one extra loop leading to writes
beyond the MSC ioremap'd space. More precisely, the value of the 'imp'
in the last loop increased beyond the msc_irqmap_t boundaries and
as a result of which, the 'n' variable was loaded with an incorrect
value. This value was used later on to calculate the offset in the
MSC01_IC_SUP which led to random crashes like the following one:

CPU 0 Unable to handle kernel paging request at virtual address e75c0200,
epc == 8058dba4, ra == 8058db90
Call Trace:
[<8058dba4>] init_msc_irqs+0x104/0x154
[<8058b5bc>] arch_init_irq+0xd8/0x154
[<805897b0>] start_kernel+0x220/0x36c

Kernel panic - not syncing: Attempted to kill the idle task!

This patch fixes the problem

Reviewed-by: James Hogan <>
Signed-off-by: Markos Chandras <>
 arch/mips/kernel/irq-msc01.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/kernel/irq-msc01.c b/arch/mips/kernel/irq-msc01.c
index 4858642d543d..a734b2c2f9ea 100644
--- a/arch/mips/kernel/irq-msc01.c
+++ b/arch/mips/kernel/irq-msc01.c
@@ -126,7 +126,7 @@ void __init init_msc_irqs(unsigned long icubase, unsigned 
int irqbase, msc_irqma
        board_bind_eic_interrupt = &msc_bind_eic_interrupt;
-       for (; nirq >= 0; nirq--, imp++) {
+       for (; nirq > 0; nirq--, imp++) {
                int n = imp->im_irq;
                switch (imp->im_type) {

<Prev in Thread] Current Thread [Next in Thread>
  • [PATCH] MIPS: msc: Prevent out-of-bounds writes to MIPS SC ioremap'd region, Markos Chandras <=