1 From 168bfeef7bba3f9784f7540b053e4ac72b769ce9 Mon Sep 17 00:00:00 2001
2 From: Andrew Morton <akpm@linux-foundation.org>
3 Date: Tue, 23 Oct 2012 14:09:39 -0700
4 Subject: amd64_edac:__amd64_set_scrub_rate(): avoid overindexing scrubrates[]
6 From: Andrew Morton <akpm@linux-foundation.org>
8 commit 168bfeef7bba3f9784f7540b053e4ac72b769ce9 upstream.
10 If none of the elements in scrubrates[] matches, this loop will cause
11 __amd64_set_scrub_rate() to incorrectly use the n+1th element.
13 As the function is designed to use the final scrubrates[] element in the
14 case of no match, we can fix this bug by simply terminating the array
15 search at the n-1th element.
17 Boris: this code is fragile anyway, see here why:
18 http://marc.info/?l=linux-kernel&m=135102834131236&w=2
20 It will be rewritten more robustly soonish.
22 Reported-by: Denis Kirjanov <kirjanov@gmail.com>
23 Cc: Doug Thompson <dougthompson@xmission.com>
24 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
25 Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
26 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
29 drivers/edac/amd64_edac.c | 11 ++++-------
30 1 file changed, 4 insertions(+), 7 deletions(-)
32 --- a/drivers/edac/amd64_edac.c
33 +++ b/drivers/edac/amd64_edac.c
34 @@ -170,8 +170,11 @@ static int __amd64_set_scrub_rate(struct
35 * memory controller and apply to register. Search for the first
36 * bandwidth entry that is greater or equal than the setting requested
37 * and program that. If at last entry, turn off DRAM scrubbing.
39 + * If no suitable bandwidth is found, turn off DRAM scrubbing entirely
40 + * by falling back to the last element in scrubrates[].
42 - for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
43 + for (i = 0; i < ARRAY_SIZE(scrubrates) - 1; i++) {
45 * skip scrub rates which aren't recommended
46 * (see F10 BKDG, F3x58)
47 @@ -181,12 +184,6 @@ static int __amd64_set_scrub_rate(struct
49 if (scrubrates[i].bandwidth <= new_bw)
53 - * if no suitable bandwidth found, turn off DRAM scrubbing
54 - * entirely by falling back to the last element in the
59 scrubval = scrubrates[i].scrubval;