android_kernel_samsung_msm8976/arch
Markos Chandras 9a87f81f93 MIPS: MSC: Prevent out-of-bounds writes to MIPS SC ioremap'd region
commit ab6c15bc6620ebe220970cc040b29bcb2757f373 upstream.

Previously, the lower limit for the MIPS SC initialization loop was
set incorrectly allowing one extra loop leading to writes
beyond the MSC ioremap'd space. More precisely, the value of the 'imp'
in the last loop increased beyond the msc_irqmap_t boundaries and
as a result of which, the 'n' variable was loaded with an incorrect
value. This value was used later on to calculate the offset in the
MSC01_IC_SUP which led to random crashes like the following one:

CPU 0 Unable to handle kernel paging request at virtual address e75c0200,
epc == 8058dba4, ra == 8058db90
[...]
Call Trace:
[<8058dba4>] init_msc_irqs+0x104/0x154
[<8058b5bc>] arch_init_irq+0xd8/0x154
[<805897b0>] start_kernel+0x220/0x36c

Kernel panic - not syncing: Attempted to kill the idle task!

This patch fixes the problem

Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Reviewed-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7118/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-07-06 18:54:13 -07:00
..
alpha
arc ARC: !PREEMPT: Ensure Return to kernel mode is IRQ safe 2014-05-13 13:59:46 +02:00
arm ARM: 8037/1: mm: support big-endian page tables 2014-06-30 20:09:44 -07:00
arm64 arm64: ptrace: change fs when passing kernel pointer to regset code 2014-06-30 20:09:42 -07:00
avr32 avr32: Makefile: add '-D__linux__' flag for gcc-4.4.7 use 2014-03-06 21:30:02 -08:00
blackfin
c6x arch: c6x: mm: include "asm/uaccess.h" to pass compiling 2013-07-21 18:21:29 -07:00
cris cris: media platform drivers: fix build 2013-11-29 11:11:53 -08:00
frv
h8300
hexagon
ia64 exec/ptrace: fix get_dumpable() incorrect tests 2013-11-29 11:11:44 -08:00
m32r
m68k m68k: Skip futex_atomic_cmpxchg_inatomic() test 2014-04-14 06:42:19 -07:00
metag metag: Reduce maximum stack size to 256MB 2014-06-07 13:25:38 -07:00
microblaze microblaze: fix clone syscall 2013-08-20 08:43:02 -07:00
mips MIPS: MSC: Prevent out-of-bounds writes to MIPS SC ioremap'd region 2014-07-06 18:54:13 -07:00
mn10300 mn10300: Use early_param() to parse "mem=" parameter 2013-06-28 16:53:03 +01:00
openrisc
parisc metag: Reduce maximum stack size to 256MB 2014-06-07 13:25:38 -07:00
powerpc powerpc: Fix 64 bit builds with binutils 2.24 2014-06-07 13:25:40 -07:00
s390 s390/lowcore: reserve 96 bytes for IRB in lowcore 2014-06-30 20:09:42 -07:00
score score: remove redundant kcore_list entries 2013-05-25 10:27:27 -07:00
sh sh: fix format string bug in stack tracer 2014-05-06 07:55:32 -07:00
sparc net: filter: fix sparc32 typo 2014-06-26 15:12:38 -04:00
tile tile: remove compat_sys_lookup_dcookie declaration to fix compile error 2014-02-13 13:48:00 -08:00
um uml: check length in exitcode_proc_write() 2013-11-13 12:05:33 +09:00
unicore32
x86 x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508) 2014-06-30 20:09:46 -07:00
xtensa xtensa: introduce spill_registers_kernel macro 2014-03-06 21:30:11 -08:00
.gitignore
Kconfig microblaze: fix clone syscall 2013-08-20 08:43:02 -07:00