On Wed, 2016-29-06 at 12:16:25 UTC, Ian Munsie wrote: > From: Ian Munsie <imun...@au1.ibm.com> > > If the AFU descriptor of an AFU directed AFU indicates that it supports > 0 maximum processes, we will accept that value and attempt to use it. > The SPA will still be allocated (with 2 pages due to another minor bug > and room for 958 processes), and when a context is allocated we will > pass the value of 0 to idr_alloc as the maximum. However, idr_alloc will > treat that as meaning no maximum and will allocate a context number and > we return a valid context. > > Conceivably, this could lead to a buffer overflow of the SPA if more > than 958 contexts were allocated, however this is mitigated by the fact > that there are no known AFUs in the wild with a bogus AFU descriptor > like this, and that only the root user is allowed to flash an AFU image > to a card. > > Add a check when validating the AFU descriptor to reject any with 0 > maximum processes. > > We do still allow a dedicated process only AFU to indicate that it > supports 0 contexts even though that is forbidden in the architecture, > as in that case we ignore the value and use 1 instead. This is just on > the off-chance that such a dedicated process AFU may exist (not that I > am aware of any), since their developers are less likely to have cared > about this value at all. > > Signed-off-by: Ian Munsie <imun...@au1.ibm.com> > Reviewed-by: Frederic Barrat <fbar...@linux.vnet.ibm.com> > Reviewed-by: Andrew Donnellan <andrew.donnel...@au1.ibm.com>
Applied to powerpc next, thanks. https://git.kernel.org/powerpc/c/49e9c99f47fc43abc9598f9fcf cheers _______________________________________________ Linuxppc-dev mailing list Linuxppc-dev@lists.ozlabs.org https://lists.ozlabs.org/listinfo/linuxppc-dev
