On 9/24/26 12:41, Prasad Kummari wrote:
mem_map_fill()'s bounds check let banks reach VERSAL2_MEM_MAP_MAX,
overwriting the array's zero terminator and writing one mm_region
past the end of versal2_mem_map[], corrupting adjacent .data with
garbage live MMU mappings.
Clamp num_banks to DRAM_BANKS at entry and explicitly memset() the
terminator slot after the loop, matching mem_map_from_dram_banks()
in cache_v8.c.
Fixes: 49b3547ce329 ("arm64: versal2: Populate DRAM banks before page table size
calculation")
Signed-off-by: Prasad Kummari <[email protected]>
---
arch/arm/mach-versal2/cpu.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/arch/arm/mach-versal2/cpu.c b/arch/arm/mach-versal2/cpu.c
index a81609cdec7..f513f06c6f8 100644
--- a/arch/arm/mach-versal2/cpu.c
+++ b/arch/arm/mach-versal2/cpu.c
@@ -92,10 +92,10 @@ void mem_map_fill(struct mm_region *bank_info, u32
num_banks)
{
int banks = VERSAL2_MEM_MAP_USED;
- for (int i = 0; i < num_banks; i++) {
- if (banks > VERSAL2_MEM_MAP_MAX)
- return;
+ if (num_banks > DRAM_BANKS)
+ num_banks = DRAM_BANKS;
+ for (int i = 0; i < num_banks; i++) {
versal2_mem_map[banks].virt = bank_info[i].phys;
versal2_mem_map[banks].phys = bank_info[i].phys;
versal2_mem_map[banks].size = bank_info[i].size;
@@ -103,6 +103,9 @@ void mem_map_fill(struct mm_region *bank_info, u32
num_banks)
PTE_BLOCK_INNER_SHARE;
banks = banks + 1;
}
+
+ /* Last slot must stay zero - it terminates the mem_map list */
+ memset(&versal2_mem_map[banks], 0, sizeof(versal2_mem_map[banks]));
}
/**
Applied.
M
