On Tue, 2015-07-21 at 12:45 +1000, Anton Blanchard wrote:
> Hi Ian,
>
> > From: Ian Munsie <imun...@au1.ibm.com>
> >
> > If the system has a PCI device with a memory-controller device node,
> > kexec-lite would spew hundreds of double free warnings and eventually
> > segfault. This would result in a "kexec load failed" message from
> > petitboot.
> >
> > This was due to kexec_memory_map() searching for "memory" nodes, but
> > actually matching any node that started with "memory", including these
> > "memory-controller" nodes. This patch changes the search to look for
> > nodes starting with "memory@", which should only match memory nodes.
>
> Nice catch! I wonder if we should be checking for device_type
> "memory". Ben?
Or at least check for the nodes at the root of the DT only.
Cheers,
Ben.
> Anton
>
> > An example of a device tree that can trigger this bug is as follows:
> >
> > {
> > pciex@3fffe40000000 {
> > ...
> > pci@0 {
> > #address-cells = <0x3>;
> > #size-cells = <0x2>;
> > ...
> > memory-controller@0 {
> > reg = <0x10000 0x0 0x0 0x0 0x0>;
> > ...
> > };
> > };
> > };
> > };
> >
> > Signed-off-by: Ian Munsie <imun...@au1.ibm.com>
> > ---
> > kexec_memory_map.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/kexec_memory_map.c b/kexec_memory_map.c
> > index fc1b7af..7f18de7 100644
> > --- a/kexec_memory_map.c
> > +++ b/kexec_memory_map.c
> > @@ -192,7 +192,7 @@ void kexec_memory_map(void *fdt, int
> > reserve_initrd)
> > name = fdt_get_name(fdt, nodeoffset, NULL);
> >
> > - if (!name || strncmp(name, "memory",
> > strlen("memory")))
> > + if (!name || strncmp(name, "memory@",
> > strlen("memory@"))) continue;
> >
> > reg = fdt_getprop(fdt, nodeoffset, "reg", &len);
_______________________________________________
Linuxppc-dev mailing list
Linuxppc-dev@lists.ozlabs.org
https://lists.ozlabs.org/listinfo/linuxppc-dev
