提交 a8c8d7c6 编写于 作者: M Martin Schwidefsky 提交者: Martin Schwidefsky

[S390] correct ipl parameter block safe guard

The 'output' variable is passed from decompress_kernel to
check_ipl_parmblock before it is initialized. That disables the
safe guard against the overwrite of the ipl parameter block.
Fix this by passing the correct value to check_ipl_parmblock.
Reported-by: NDavid Binderman <dcb314@hotmail.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
上级 03e3b5a0
...@@ -133,11 +133,12 @@ unsigned long decompress_kernel(void) ...@@ -133,11 +133,12 @@ unsigned long decompress_kernel(void)
unsigned long output_addr; unsigned long output_addr;
unsigned char *output; unsigned char *output;
check_ipl_parmblock((void *) 0, (unsigned long) output + SZ__bss_start); output_addr = ((unsigned long) &_end + HEAP_SIZE + 4095UL) & -4096UL;
check_ipl_parmblock((void *) 0, output_addr + SZ__bss_start);
memset(&_bss, 0, &_ebss - &_bss); memset(&_bss, 0, &_ebss - &_bss);
free_mem_ptr = (unsigned long)&_end; free_mem_ptr = (unsigned long)&_end;
free_mem_end_ptr = free_mem_ptr + HEAP_SIZE; free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
output = (unsigned char *) ((free_mem_end_ptr + 4095UL) & -4096UL); output = (unsigned char *) output_addr;
#ifdef CONFIG_BLK_DEV_INITRD #ifdef CONFIG_BLK_DEV_INITRD
/* /*
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册