From: "Mark Langsdorf" <mark.langsdorf@amd.com>
Subject: [PATCH][cpufreq] add bounds checking to cpufreq_stats.c
 from upstream
Date: Wed, 12 Dec 2007 18:18:15 -0600
Message-ID: <200712121818.15278.mark.langsdorf@amd.com>
Mime-Version: 1.0
Content-Type: text/plain;
 charset=us-ascii
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xensource.com>
Content-Disposition: inline
List-Unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: xen-devel@lists.xensource.com, Joachim Deguara <joachim.deguara@amd.com>
List-Id: xen-devel@lists.xenproject.org

The cpufreq_stats.c will attempt to use an error return value as
an index to an array, causing the kernel to oops.  Stop that by
doing bounds checking.

This is a backport of upstream code.

Signed-off-by: Mark Langsdorf <mark.langsdorf@amd.com>

-Mark Langsdorf
Operating System Research Center
AMD

diff -r cd744c5ec950 drivers/cpufreq/cpufreq_stats.c
--- a/drivers/cpufreq/cpufreq_stats.c	Wed Dec 12 10:18:35 2007 +0000
+++ b/drivers/cpufreq/cpufreq_stats.c	Wed Dec 12 18:02:54 2007 -0600
@@ -292,6 +292,9 @@ cpufreq_stat_notifier_trans (struct noti
 	if (old_index == new_index)
 		return 0;
 
+        if ((old_index < 0) || (new_index < 0))
+                return 0;
+
 	spin_lock(&cpufreq_stats_lock);
 	stat->last_index = new_index;
 #ifdef CONFIG_CPU_FREQ_STAT_DETAILS