Hi,
> > Nice catch! I wonder if we should be checking for device_type
> > "memory". Ben?
>
> Yes. That's what Linux does.
Ian: I made that change, and slightly modified your commit message.
Look ok?
Anton
--
[PATCH] Fix crash due to processing "memory-controller" nodes as "memory"
If the system has a PCI device with a memory-controller device node,
kexec-lite would spew hundreds of double free warnings and eventually
segfault. This would result in a "kexec load failed" message from
petitboot.
This was due to kexec_memory_map() searching for "memory" nodes, but
actually matching any node that started with "memory", including these
"memory-controller" nodes. This patch changes the search to look for
nodes with a device_type of "memory", which should only match memory
nodes.
An example of a device tree that can trigger this bug is as follows:
{
pciex@3fffe40000000 {
...
pci@0 {
#address-cells = <0x3>;
#size-cells = <0x2>;
...
memory-controller@0 {
reg = <0x10000 0x0 0x0 0x0 0x0>;
...
};
};
};
};
Signed-off-by: Ian Munsie <imun...@au1.ibm.com>
Signed-off-by: Anton Blanchard <an...@samba.org>
---
kexec_memory_map.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kexec_memory_map.c b/kexec_memory_map.c
index fc1b7af..6103590 100644
--- a/kexec_memory_map.c
+++ b/kexec_memory_map.c
@@ -182,7 +182,7 @@ void kexec_memory_map(void *fdt, int reserve_initrd)
}
while (1) {
- const char *name;
+ const char *type;
int len;
const fdt64_t *reg;
@@ -190,9 +190,9 @@ void kexec_memory_map(void *fdt, int reserve_initrd)
if (nodeoffset < 0)
break;
- name = fdt_get_name(fdt, nodeoffset, NULL);
+ type = fdt_getprop(fdt, nodeoffset, "device_type", NULL);
- if (!name || strncmp(name, "memory", strlen("memory")))
+ if (!type || strcmp(type, "memory"))
continue;
reg = fdt_getprop(fdt, nodeoffset, "reg", &len);
--
2.1.0
_______________________________________________
Linuxppc-dev mailing list
Linuxppc-dev@lists.ozlabs.org
https://lists.ozlabs.org/listinfo/linuxppc-dev
