powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"

All these commands end up peeking into the PACA using the user
originated cpu id as an index. Check the cpu id is valid in order
to prevent xmon to crash. Instead of printing an error, this follows
the same behavior as the "lp s #" command : ignore the buggy cpu id
parameter and fall back to the #-less version of the command.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/161531347060.252863.10490063933688958044.stgit@bahia.lan

diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index d79d6633f33363123b136d973787544b2c989a51..bd4813bad317eb6ed7591768bc327e3645241a5b 100644 (file)
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -1350,7 +1350,7 @@ static int cpu_cmd(void)
        }
        termch = cpu;
 
-       if (!scanhex(&cpu)) {
+       if (!scanhex(&cpu) || cpu >= num_possible_cpus()) {
                /* print cpus waiting or in xmon */
                printf("cpus stopped:");
                last_cpu = first_cpu = NR_CPUS;
@@ -2772,7 +2772,7 @@ static void dump_pacas(void)
 
        termch = c;     /* Put c back, it wasn't 'a' */
 
-       if (scanhex(&num))
+       if (scanhex(&num) && num < num_possible_cpus())
                dump_one_paca(num);
        else
                dump_one_paca(xmon_owner);
@@ -2845,7 +2845,7 @@ static void dump_xives(void)
 
        termch = c;     /* Put c back, it wasn't 'a' */
 
-       if (scanhex(&num))
+       if (scanhex(&num) && num < num_possible_cpus())
                dump_one_xive(num);
        else
                dump_one_xive(xmon_owner);