Re: [PATCHv2] cpufreq: fix overflow in cpufreq_table_find_index_dl()

[Viresh Kumar]

On 18-10-16, 00:41, Sergey Senozhatsky wrote:
> 'best' is always less or equals to 'pos', so `best - pos' returns
> a negative value which is then getting casted to `unsigned int'
> and passed to __cpufreq_driver_target()->acpi_cpufreq_target()
> for policy->freq_table selection. This results in
> 
>  BUG: unable to handle kernel paging request at 881019b469f8
>  IP: [] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq]
>  PGD 267f067
>  PUD 0
> 
>  Oops:  [#1] PREEMPT SMP
>  CPU: 6 PID: 70 Comm: kworker/6:1 Not tainted 
> 4.9.0-rc1-next-20161017-dbg-dirty
>  Workqueue: events dbs_work_handler
>  task: 88041b808000 task.stack: 88041b81
>  RIP: 0010:[]  [] 
> acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq]
>  RSP: 0018:88041b813c60  EFLAGS: 00010282
>  RAX: 880419b46a00 RBX: 88041b848400 RCX: 880419b20f80
>  RDX: 001dff38 RSI:  RDI: 88041b848400
>  RBP: 88041b813cb0 R08: 0006 R09: 0040
>  R10: 8207f9e0 R11: 8173595b R12: 
>  R13: 88041f1dff38 R14: 00262900 R15: 000bfff4
>  FS:  () GS:88041f00() knlGS:
>  CS:  0010 DS:  ES:  CR0: 80050033
>  CR2: 881019b469f8 CR3: 00041a2d3000 CR4: 001406e0
>  Stack:
>   88041b813cb0 813347f9 88041b813ca0 81334663
>   88041f1d4bc0 88041b848400  
>   00262900  88041b813d00 813355dc
>  Call Trace:
>   [] ? cpufreq_freq_transition_begin+0xf1/0xfc
>   [] ? get_cpu_idle_time+0x97/0xa6
>   [] __cpufreq_driver_target+0x3b6/0x44e
>   [] cs_dbs_timer+0x11a/0x135
>   [] dbs_work_handler+0x39/0x62
>   [] process_one_work+0x280/0x4a5
>   [] worker_thread+0x24f/0x397
>   [] ? rescuer_thread+0x30b/0x30b
>   [] ? nl80211_get_key+0x29/0x36a
>   [] kthread+0xfc/0x104
>   [] ? put_lock_stats.isra.9+0xe/0x20
>   [] ? kthread_create_on_node+0x3f/0x3f
>   [] ret_from_fork+0x22/0x30
>  Code: 56 4d 6b ff 0c 41 55 41 54 53 48 83 ec 28 48 8b 15 ad 1e 00 00 44 8b 41
>  08 48 8b 87 c8 00 00 00 49 89 d5 4e 03 2c c5 80 b2 78 81 <46> 8b 74 38 04 45
>  3b 75 00 75 11 31 c0 83 39 00 0f 84 1c 01 00
>  RIP  [] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq]
>   RSP 
>  CR2: 881019b469f8
>  ---[ end trace 16d9fc7a17897d37 ]---
> 
> Signed-off-by: Sergey Senozhatsky 
> ---
>  include/linux/cpufreq.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
> index 5fa55fc..32dc0cbd 100644
> --- a/include/linux/cpufreq.h
> +++ b/include/linux/cpufreq.h
> @@ -677,10 +677,10 @@ static inline int cpufreq_table_find_index_dl(struct 
> cpufreq_policy *policy,
>   if (best == table - 1)
>   return pos - table;
>  
> - return best - pos;
> + return best - table;
>   }
>  
> - return best - pos;
> + return best - table;
>  }
>  

Acked-by: Viresh Kumar 

-- 
viresh

Re: [PATCHv2] cpufreq: fix overflow in cpufreq_table_find_index_dl()

[Viresh Kumar]

On 18-10-16, 00:41, Sergey Senozhatsky wrote:
> 'best' is always less or equals to 'pos', so `best - pos' returns
> a negative value which is then getting casted to `unsigned int'
> and passed to __cpufreq_driver_target()->acpi_cpufreq_target()
> for policy->freq_table selection. This results in
> 
>  BUG: unable to handle kernel paging request at 881019b469f8
>  IP: [] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq]
>  PGD 267f067
>  PUD 0
> 
>  Oops:  [#1] PREEMPT SMP
>  CPU: 6 PID: 70 Comm: kworker/6:1 Not tainted 
> 4.9.0-rc1-next-20161017-dbg-dirty
>  Workqueue: events dbs_work_handler
>  task: 88041b808000 task.stack: 88041b81
>  RIP: 0010:[]  [] 
> acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq]
>  RSP: 0018:88041b813c60  EFLAGS: 00010282
>  RAX: 880419b46a00 RBX: 88041b848400 RCX: 880419b20f80
>  RDX: 001dff38 RSI:  RDI: 88041b848400
>  RBP: 88041b813cb0 R08: 0006 R09: 0040
>  R10: 8207f9e0 R11: 8173595b R12: 
>  R13: 88041f1dff38 R14: 00262900 R15: 000bfff4
>  FS:  () GS:88041f00() knlGS:
>  CS:  0010 DS:  ES:  CR0: 80050033
>  CR2: 881019b469f8 CR3: 00041a2d3000 CR4: 001406e0
>  Stack:
>   88041b813cb0 813347f9 88041b813ca0 81334663
>   88041f1d4bc0 88041b848400  
>   00262900  88041b813d00 813355dc
>  Call Trace:
>   [] ? cpufreq_freq_transition_begin+0xf1/0xfc
>   [] ? get_cpu_idle_time+0x97/0xa6
>   [] __cpufreq_driver_target+0x3b6/0x44e
>   [] cs_dbs_timer+0x11a/0x135
>   [] dbs_work_handler+0x39/0x62
>   [] process_one_work+0x280/0x4a5
>   [] worker_thread+0x24f/0x397
>   [] ? rescuer_thread+0x30b/0x30b
>   [] ? nl80211_get_key+0x29/0x36a
>   [] kthread+0xfc/0x104
>   [] ? put_lock_stats.isra.9+0xe/0x20
>   [] ? kthread_create_on_node+0x3f/0x3f
>   [] ret_from_fork+0x22/0x30
>  Code: 56 4d 6b ff 0c 41 55 41 54 53 48 83 ec 28 48 8b 15 ad 1e 00 00 44 8b 41
>  08 48 8b 87 c8 00 00 00 49 89 d5 4e 03 2c c5 80 b2 78 81 <46> 8b 74 38 04 45
>  3b 75 00 75 11 31 c0 83 39 00 0f 84 1c 01 00
>  RIP  [] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq]
>   RSP 
>  CR2: 881019b469f8
>  ---[ end trace 16d9fc7a17897d37 ]---
> 
> Signed-off-by: Sergey Senozhatsky 
> ---
>  include/linux/cpufreq.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
> index 5fa55fc..32dc0cbd 100644
> --- a/include/linux/cpufreq.h
> +++ b/include/linux/cpufreq.h
> @@ -677,10 +677,10 @@ static inline int cpufreq_table_find_index_dl(struct 
> cpufreq_policy *policy,
>   if (best == table - 1)
>   return pos - table;
>  
> - return best - pos;
> + return best - table;
>   }
>  
> - return best - pos;
> + return best - table;
>  }
>  

Acked-by: Viresh Kumar 

-- 
viresh