diff options
| author | Grant Likely <grant.likely@linaro.org> | 2013-10-04 17:24:26 +0100 |
|---|---|---|
| committer | Grant Likely <grant.likely@linaro.org> | 2013-10-15 20:09:18 +0100 |
| commit | f3cea45a77c8ebdb7efad100e576eb6cb401bf25 (patch) | |
| tree | ae7be3718ae93dc224bee399384ae07d013d8c07 /drivers/of/base.c | |
| parent | d1cb9d1af0bc11b7450a6032f43935c746609418 (diff) | |
| download | lwn-f3cea45a77c8ebdb7efad100e576eb6cb401bf25.tar.gz lwn-f3cea45a77c8ebdb7efad100e576eb6cb401bf25.zip | |
of: Fix iteration bug over CPU reg properties
The size of each hwid in a cpu nodes 'reg' property is defined by the
parents #address-cells property in the normal way. The cpu parsing code
has a bug where it will overrun the end of the property if
address-cells is greater than one. This commit fixes the problem by
adjusting the array size by the number of address cells. It also makes
sure address-cells isn't zero for that would cause an infinite loop.
v2: bail if #address-cells is zero instead of forcing to
OF_ROOT_NODE_ADDR_CELLS_DEFAULT. Forcing it will cause the reg
property to be parsed incorrectly.
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Cc: Rob Herring <rob.herring@calxeda.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Diffstat (limited to 'drivers/of/base.c')
| -rw-r--r-- | drivers/of/base.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/of/base.c b/drivers/of/base.c index e4c99453adf1..3ae106d89791 100644 --- a/drivers/of/base.c +++ b/drivers/of/base.c @@ -265,9 +265,9 @@ static bool __of_find_n_match_cpu_property(struct device_node *cpun, ac = of_n_addr_cells(cpun); cell = of_get_property(cpun, prop_name, &prop_len); - if (!cell) + if (!cell || !ac) return false; - prop_len /= sizeof(*cell); + prop_len /= sizeof(*cell) * ac; for (tid = 0; tid < prop_len; tid++) { hwid = of_read_number(cell, ac); if (arch_match_cpu_phys_id(cpu, hwid)) { |