diff options
| author | Greg Kurz <groug@kaod.org> | 2021-03-09 19:11:10 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-07-18 13:05:40 +0200 |
| commit | 6b84e9d53bc0156c129f1be05e57c4701b80ab9d (patch) | |
| tree | 9460c5a5857db2d0c6fc67a4bf38442b6077c0f6 /arch/powerpc | |
| parent | 9d046f697e9a409597feb6f81a20d074f5a195f0 (diff) | |
| download | linux-6b84e9d53bc0156c129f1be05e57c4701b80ab9d.tar.gz linux-6b84e9d53bc0156c129f1be05e57c4701b80ab9d.tar.bz2 linux-6b84e9d53bc0156c129f1be05e57c4701b80ab9d.zip | |
powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
[ Upstream commit 8873aab8646194a4446117bb617cc71bddda2dee ]
All these commands end up peeking into the PACA using the user
originated cpu id as an index. Check the cpu id is valid in order
to prevent xmon to crash. Instead of printing an error, this follows
the same behavior as the "lp s #" command : ignore the buggy cpu id
parameter and fall back to the #-less version of the command.
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/161531347060.252863.10490063933688958044.stgit@bahia.lan
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'arch/powerpc')
| -rw-r--r-- | arch/powerpc/xmon/xmon.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c index 3de2adc0a807..a2883360d07c 100644 --- a/arch/powerpc/xmon/xmon.c +++ b/arch/powerpc/xmon/xmon.c @@ -1249,7 +1249,7 @@ static int cpu_cmd(void) unsigned long cpu, first_cpu, last_cpu; int timeout; - if (!scanhex(&cpu)) { + if (!scanhex(&cpu) || cpu >= num_possible_cpus()) { /* print cpus waiting or in xmon */ printf("cpus stopped:"); last_cpu = first_cpu = NR_CPUS; @@ -2680,7 +2680,7 @@ static void dump_pacas(void) termch = c; /* Put c back, it wasn't 'a' */ - if (scanhex(&num)) + if (scanhex(&num) && num < num_possible_cpus()) dump_one_paca(num); else dump_one_paca(xmon_owner); @@ -2777,7 +2777,7 @@ static void dump_xives(void) termch = c; /* Put c back, it wasn't 'a' */ - if (scanhex(&num)) + if (scanhex(&num) && num < num_possible_cpus()) dump_one_xive(num); else dump_one_xive(xmon_owner); |