releases/4.8.5/cpufreq-fix-overflow-in-cpufreq_table_find_index_dl.patch

   1 From c6fe46a79ecd79606bb96fada4515f6b23f87b62 Mon Sep 17 00:00:00 2001
   2 From: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
   3 Date: Tue, 18 Oct 2016 00:41:12 +0900
   4 Subject: cpufreq: fix overflow in cpufreq_table_find_index_dl()
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 From: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
  10
  11 commit c6fe46a79ecd79606bb96fada4515f6b23f87b62 upstream.
  12
  13 'best' is always less or equals to 'pos', so `best - pos' returns
  14 a negative value which is then getting casted to `unsigned int'
  15 and passed to __cpufreq_driver_target()->acpi_cpufreq_target()
  16 for policy->freq_table selection. This results in
  17
  18  BUG: unable to handle kernel paging request at ffff881019b469f8
  19  IP: [<ffffffffa00356c1>] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq]
  20  PGD 267f067
  21  PUD 0
  22
  23  Oops: 0000 [#1] PREEMPT SMP
  24  CPU: 6 PID: 70 Comm: kworker/6:1 Not tainted 4.9.0-rc1-next-20161017-dbg-dirty
  25  Workqueue: events dbs_work_handler
  26  task: ffff88041b808000 task.stack: ffff88041b810000
  27  RIP: 0010:[<ffffffffa00356c1>]  [<ffffffffa00356c1>] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq]
  28  RSP: 0018:ffff88041b813c60  EFLAGS: 00010282
  29  RAX: ffff880419b46a00 RBX: ffff88041b848400 RCX: ffff880419b20f80
  30  RDX: 00000000001dff38 RSI: 00000000ffffffff RDI: ffff88041b848400
  31  RBP: ffff88041b813cb0 R08: 0000000000000006 R09: 0000000000000040
  32  R10: ffffffff8207f9e0 R11: ffffffff8173595b R12: 0000000000000000
  33  R13: ffff88041f1dff38 R14: 0000000000262900 R15: 0000000bfffffff4
  34  FS:  0000000000000000(0000) GS:ffff88041f000000(0000) knlGS:0000000000000000
  35  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  36  CR2: ffff881019b469f8 CR3: 000000041a2d3000 CR4: 00000000001406e0
  37  Stack:
  38   ffff88041b813cb0 ffffffff813347f9 ffff88041b813ca0 ffffffff81334663
  39   ffff88041f1d4bc0 ffff88041b848400 0000000000000000 0000000000000000
  40   0000000000262900 0000000000000000 ffff88041b813d00 ffffffff813355dc
  41  Call Trace:
  42   [<ffffffff813347f9>] ? cpufreq_freq_transition_begin+0xf1/0xfc
  43   [<ffffffff81334663>] ? get_cpu_idle_time+0x97/0xa6
  44   [<ffffffff813355dc>] __cpufreq_driver_target+0x3b6/0x44e
  45   [<ffffffff81336ca3>] cs_dbs_timer+0x11a/0x135
  46   [<ffffffff81336fda>] dbs_work_handler+0x39/0x62
  47   [<ffffffff81057823>] process_one_work+0x280/0x4a5
  48   [<ffffffff81058719>] worker_thread+0x24f/0x397
  49   [<ffffffff810584ca>] ? rescuer_thread+0x30b/0x30b
  50   [<ffffffff81418380>] ? nl80211_get_key+0x29/0x36a
  51   [<ffffffff8105d2b7>] kthread+0xfc/0x104
  52   [<ffffffff8107ceea>] ? put_lock_stats.isra.9+0xe/0x20
  53   [<ffffffff8105d1bb>] ? kthread_create_on_node+0x3f/0x3f
  54   [<ffffffff814b2092>] ret_from_fork+0x22/0x30
  55  Code: 56 4d 6b ff 0c 41 55 41 54 53 48 83 ec 28 48 8b 15 ad 1e 00 00 44 8b 41
  56  08 48 8b 87 c8 00 00 00 49 89 d5 4e 03 2c c5 80 b2 78 81 <46> 8b 74 38 04 45
  57  3b 75 00 75 11 31 c0 83 39 00 0f 84 1c 01 00
  58  RIP  [<ffffffffa00356c1>] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq]
  59   RSP <ffff88041b813c60>
  60  CR2: ffff881019b469f8
  61  ---[ end trace 16d9fc7a17897d37 ]---
  62
  63 [ rjw: In some cases this bug may also cause incorrect frequencies to
  64   be selected by cpufreq governors. ]
  65
  66 Fixes: 899bb6642f2a (cpufreq: skip invalid entries when searching the frequency)
  67 Link: http://marc.info/?l=linux-kernel&m=147672030714331&w=2
  68 Reported-and-tested-by: Sedat Dilek <sedat.dilek@gmail.com>
  69 Reported-and-tested-by: Jörg Otte <jrg.otte@gmail.com>
  70 Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
  71 Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
  72 Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
  73 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  74
  75 ---
  76  include/linux/cpufreq.h |    4 ++--
  77  1 file changed, 2 insertions(+), 2 deletions(-)
  78
  79 --- a/include/linux/cpufreq.h
  80 +++ b/include/linux/cpufreq.h
  81 @@ -677,10 +677,10 @@ static inline int cpufreq_table_find_ind
  82                 if (best == table - 1)
  83                         return pos - table;
  84
  85 -               return best - pos;
  86 +               return best - table;
  87         }
  88
  89 -       return best - pos;
  90 +       return best - table;
  91  }
  92
  93  /* Works only on sorted freq-tables */