Skip to contentSkip to conversation

ACPI / CPPC: Fix negative array index read in cppc_set_perf

PATCH In review Gustavo A. R. Silva 3 participants 3 messages Dec 13, 2017 – Dec 16, 2017

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 ACPI / CPPC: Fix negative array index read in cppc_set_perf

If pcc_ss_id is less than 0, there is a negative array index read before verifying pcc_ss_id is not a negative value.

Fix this by removing the code that triggers this issue.

Notice that this code is already properly placed after the check on pcc_ss_id at line 1182: pcc_ss_data = pcc_data[pcc_ss_id];

Addresses-Coverity-ID: 1426090 ("Negative array index read")

Fixes 1ecbd7170d65 ("ACPI / CPPC: Fix KASAN global out of bounds warning")
---
 drivers/acpi/cppc_acpi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/cppc_acpi.c +1 -1
index 30e84cc..06ea474 100644
@@ -1171,7 +1171,7 @@ int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)
 	struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);
 	struct cpc_register_resource *desired_reg;
 	int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
-	struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id];
+	struct cppc_pcc_data *pcc_ss_data;
 	int ret = 0;
 
 	if (!cpc_desc || pcc_ss_id < 0) {
Signature · 1 line
2.7.4
Reviewed-by on v1 1/1
#1 lore raw
Quoted 10 lines · Gustavo A. R. Silva

If pcc_ss_id is less than 0, there is a negative array index read before verifying pcc_ss_id is not a negative value.

Fix this by removing the code that triggers this issue.

Notice that this code is already properly placed after the check on pcc_ss_id at line 1182: pcc_ss_data = pcc_data[pcc_ss_id];

Addresses-Coverity-ID: 1426090 ("Negative array index read")

Fixes 1ecbd7170d65 ("ACPI / CPPC: Fix KASAN global out of bounds warning")
Quoted 18 lines
---
  drivers/acpi/cppc_acpi.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/cppc_acpi.c +1 -1
index 30e84cc..06ea474 100644
@@ -1171,7 +1171,7 @@ int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)
  	struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);
  	struct cpc_register_resource *desired_reg;
  	int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
-	struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id];
+	struct cppc_pcc_data *pcc_ss_data;
  	int ret = 0;
 
  	if (!cpc_desc || pcc_ss_id < 0) {
#2 lore raw
In reply to Gustavo A. R. Silva
Quoted 21 lines · CET Gustavo A. R. Silva

If pcc_ss_id is less than 0, there is a negative array index read before verifying pcc_ss_id is not a negative value.

Fix this by removing the code that triggers this issue.

Notice that this code is already properly placed after the check on pcc_ss_id at line 1182: pcc_ss_data = pcc_data[pcc_ss_id];

Addresses-Coverity-ID: 1426090 ("Negative array index read")

Fixes 1ecbd7170d65 ("ACPI / CPPC: Fix KASAN global out of bounds warning")
---
 drivers/acpi/cppc_acpi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/cppc_acpi.c +0 -0
index 30e84cc..06ea474 100644

drivers/acpi/cppc_acpi.c int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls) · line 1177

Quoted 8 lines
drivers/acpi/cppc_acpi.c +1 -1
@@ -1171,7 +1171,7 @@ int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)
 	struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);
 	struct cpc_register_resource *desired_reg;
 	int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
-	struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id];
+	struct cppc_pcc_data *pcc_ss_data;
 	int ret = 0;
 
 	if (!cpc_desc || pcc_ss_id < 0) {

I applied a patch from Coling Ian King that did the same thing and was posted eaelier.

Thanks,
Rafael