[Skiboot] [PATCH] hdata/iohub: Check IOHUB child count before using

Vasant Hegde hegdevasant at linux.vnet.ibm.com
Thu Oct 5 20:07:55 AEDT 2017

..else we endup getting below calltrace in older system.

[  169.179598388,3] HDIF: child array idx out of range!
CPU 085c Backtrace:
 S: 0000000033d739b0 R: 00000000300136e8   .backtrace+0x40
 S: 0000000033d73a50 R: 00000000300a1510   .HDIF_child_arr+0x34
 S: 0000000033d73ac0 R: 00000000300a47a8   .io_parse+0x708
 S: 0000000033d73c80 R: 000000003009f4ec   .parse_hdat+0x177c
 S: 0000000033d73e30 R: 0000000030014750   .main_cpu_entry+0x148
 S: 0000000033d73f00 R: 0000000030002690   boot_entry+0x198

Fixes: ad484081 (hdata: Parse IOSLOT information)
CC: Oliver O'Halloran <oohall at gmail.com>
Signed-off-by: Vasant Hegde <hegdevasant at linux.vnet.ibm.com>
 hdata/iohub.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hdata/iohub.c b/hdata/iohub.c
index 4c4178d..134fa04 100644
--- a/hdata/iohub.c
+++ b/hdata/iohub.c
@@ -790,7 +790,7 @@ static struct dt_node *get_slot_node(void)
 	return slots;
-static void io_parse_slots(const void *sp_iohubs, int hub_id)
+static void io_parse_slots(const struct HDIF_common_hdr *sp_iohubs, int hub_id)
 	const struct HDIF_child_ptr *ioslot_arr;
 	const struct HDIF_array_hdr *entry_arr;
@@ -798,6 +798,9 @@ static void io_parse_slots(const void *sp_iohubs, int hub_id)
 	const struct slot_map_entry *entry;
 	unsigned int i, count;
+	if (sp_iohubs->child_count <= CECHUB_CHILD_IOSLOTS)
+		return;
 	ioslot_arr = HDIF_child_arr(sp_iohubs, CECHUB_CHILD_IOSLOTS);
 	if (!ioslot_arr)

More information about the Skiboot mailing list