ACPI / CPPC: Fix negative array index read in cppc_set_perf
PATCH 1/1 ACPI / CPPC: Fix negative array index read in cppc_set_perf
If pcc_ss_id is less than 0, there is a negative array index read before verifying pcc_ss_id is not a negative value.
Fix this by removing the code that triggers this issue.
Notice that this code is already properly placed after the check on pcc_ss_id at line 1182: pcc_ss_data = pcc_data[pcc_ss_id];
Addresses-Coverity-ID: 1426090 ("Negative array index read")
--- drivers/acpi/cppc_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/cppc_acpi.c +1 -1
@@ -1171,7 +1171,7 @@ int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)struct cpc_desc *cpc_desc =per_cpu (cpc_desc_ptr, cpu);struct cpc_register_resource *desired_reg;int pcc_ss_id =per_cpu (cpu_pcc_subspace_idx, cpu); -struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id]; +struct cppc_pcc_data *pcc_ss_data;int ret =0 ;if (!cpc_desc || pcc_ss_id <0 ) {
Signature · 1 line
2.7.4
Quoted 10 lines · Gustavo A. R. Silva
If
pcc_ss_idis less than 0, there is a negative array index read before verifyingpcc_ss_idis not a negative value.Fix this by removing the code that triggers this issue.
Notice that this code is already properly placed after the check on
pcc_ss_idat line 1182:pcc_ss_data= pcc_data[pcc_ss_id];Addresses-Coverity-ID: 1426090 ("Negative array index read")
Fixes 1ecbd7170d65 ("ACPI / CPPC: Fix KASAN global out of bounds warning")
Quoted 18 lines
Signed-off-by Gustavo A. R. Silva <[email protected]>--- drivers/acpi/cppc_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/acpi/cppc_acpi.c +1
-1@@ -1171,7 +1171,7 @@ int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)struct cpc_desc *cpc_desc =per_cpu (cpc_desc_ptr, cpu);struct cpc_register_resource *desired_reg;int pcc_ss_id =per_cpu (cpu_pcc_subspace_idx, cpu); -struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id]; +struct cppc_pcc_data *pcc_ss_data;int ret =0 ;if (!cpc_desc || pcc_ss_id <0 ) {
Quoted 21 lines · CET Gustavo A. R. Silva
If
pcc_ss_idis less than 0, there is a negative array index read before verifyingpcc_ss_idis not a negative value.Fix this by removing the code that triggers this issue.
Notice that this code is already properly placed after the check on
pcc_ss_idat line 1182:pcc_ss_data= pcc_data[pcc_ss_id];Addresses-Coverity-ID: 1426090 ("Negative array index read")
Fixes 1ecbd7170d65 ("ACPI / CPPC: Fix KASAN global out of bounds warning")Signed-off-by Gustavo A. R. Silva <[email protected]>--- drivers/acpi/cppc_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/acpi/cppc_acpi.c +0
-0
drivers/acpi/cppc_acpi.c int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls) · line 1177
Quoted 8 lines
drivers/acpi/cppc_acpi.c +1
-1@@ -1171,7 +1171,7 @@ int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)struct cpc_desc *cpc_desc =per_cpu (cpc_desc_ptr, cpu);struct cpc_register_resource *desired_reg;int pcc_ss_id =per_cpu (cpu_pcc_subspace_idx, cpu); -struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id]; +struct cppc_pcc_data *pcc_ss_data;int ret =0 ;if (!cpc_desc || pcc_ss_id <0 ) {
I applied a patch from Coling Ian King that did the same thing and was posted eaelier.
Thanks,
Rafael