[ARM] 5560/1: Avoid buffer overrun in case of an invalid IRQ

handle_bad_irq() expects the IRQ number to be valid (used for statistics),
so it cannot be called with an illegal vector. The problem was reported
by a static analysis tool.

The change makes bad_irq_desc redundant, so delete it.

Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index 096f600dc8d84e25603f9269cbfebeab634ac4d6..b7c3490eaa24adb04bc7e7b2f971f5980f245221 100644 (file)
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -98,17 +98,6 @@ unlock:
        return 0;
 }
 
-/* Handle bad interrupts */
-static struct irq_desc bad_irq_desc = {
-       .handle_irq = handle_bad_irq,
-       .lock = __SPIN_LOCK_UNLOCKED(bad_irq_desc.lock),
-};
-
-#ifdef CONFIG_CPUMASK_OFFSTACK
-/* We are not allocating bad_irq_desc.affinity or .pending_mask */
-#error "ARM architecture does not support CONFIG_CPUMASK_OFFSTACK."
-#endif
-
 /*
  * do_IRQ handles all hardware IRQ's.  Decoded IRQs should not
  * come via this function.  Instead, they should provide their
@@ -124,10 +113,13 @@ asmlinkage void __exception asm_do_IRQ(unsigned int irq, struct pt_regs *regs)
         * Some hardware gives randomly wrong interrupts.  Rather
         * than crashing, do something sensible.
         */
-       if (irq >= NR_IRQS)
-               handle_bad_irq(irq, &bad_irq_desc);
-       else
+       if (unlikely(irq >= NR_IRQS)) {
+               if (printk_ratelimit())
+                       printk(KERN_WARNING "Bad IRQ%u\n", irq);
+               ack_bad_irq(irq);
+       } else {
                generic_handle_irq(irq);
+       }
 
        /* AT91 specific workaround */
        irq_finish(irq);
@@ -165,10 +157,6 @@ void __init init_IRQ(void)
        for (irq = 0; irq < NR_IRQS; irq++)
                irq_desc[irq].status |= IRQ_NOREQUEST | IRQ_NOPROBE;
 
-#ifdef CONFIG_SMP
-       cpumask_setall(bad_irq_desc.affinity);
-       bad_irq_desc.node = smp_processor_id();
-#endif
        init_arch_irq();
 }