diff options
| author | John Baldwin <jhb@FreeBSD.org> | 2023-09-09 19:13:57 +0000 |
|---|---|---|
| committer | John Baldwin <jhb@FreeBSD.org> | 2023-09-09 19:13:57 +0000 |
| commit | d0af08c4ba3e400049d246d72401ce36d3bee98a (patch) | |
| tree | b0f0a17c636dbe1213c3725b0d2fae1e4d92a042 | |
| parent | 98b98ec1bc7e961c3d3468b0e481080580c902cf (diff) | |
| download | src-d0af08c4ba3e400049d246d72401ce36d3bee98a.tar.gz src-d0af08c4ba3e400049d246d72401ce36d3bee98a.zip | |
gic_acpi: Limit the number of CPUs to GIC_MAXCPU
madt_table_data contains an array of pointers for each CPU and was
allocated on the stack. If MAXCPU is raised to a sufficiently large
value this can overflow the kernel stack. Cap the stack growth by
using GIC_MAXCPU instead as for other parts of the gicv1/v2 driver in
commit a0e20c0ded1a.
Suggested by: andrew
Reviewed by: andrew, emaste
Obtained from: CheriBSD
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D41800
| -rw-r--r-- | sys/arm/arm/gic_acpi.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/arm/arm/gic_acpi.c b/sys/arm/arm/gic_acpi.c index e18bc12faf4d..56ff78f9b685 100644 --- a/sys/arm/arm/gic_acpi.c +++ b/sys/arm/arm/gic_acpi.c @@ -84,7 +84,7 @@ EARLY_DRIVER_MODULE(gic, acpi, gic_acpi_driver, 0, 0, struct madt_table_data { device_t parent; ACPI_MADT_GENERIC_DISTRIBUTOR *dist; - ACPI_MADT_GENERIC_INTERRUPT *intr[MAXCPU]; + ACPI_MADT_GENERIC_INTERRUPT *intr[GIC_MAXCPU]; }; static void @@ -107,7 +107,7 @@ madt_handler(ACPI_SUBTABLE_HEADER *entry, void *arg) break; case ACPI_MADT_TYPE_GENERIC_INTERRUPT: intr = (ACPI_MADT_GENERIC_INTERRUPT *)entry; - if (intr->CpuInterfaceNumber < MAXCPU) + if (intr->CpuInterfaceNumber < GIC_MAXCPU) madt_data->intr[intr->CpuInterfaceNumber] = intr; break; } @@ -151,7 +151,7 @@ gic_acpi_identify(driver_t *driver, device_t parent) } intr = NULL; - for (i = 0; i < MAXCPU; i++) { + for (i = 0; i < GIC_MAXCPU; i++) { if (madt_data.intr[i] != NULL) { if (intr == NULL) { intr = madt_data.intr[i]; |