From: Greg Kroah-Hartman Date: Sun, 3 Apr 2022 13:49:21 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v5.17.2~107 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d1d3448c5d75871736a72c011f7698c30858d808;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: acpi-cppc-avoid-out-of-bounds-access-when-parsing-_cpc-data.patch --- diff --git a/queue-4.9/acpi-cppc-avoid-out-of-bounds-access-when-parsing-_cpc-data.patch b/queue-4.9/acpi-cppc-avoid-out-of-bounds-access-when-parsing-_cpc-data.patch new file mode 100644 index 00000000000..859017e3d6b --- /dev/null +++ b/queue-4.9/acpi-cppc-avoid-out-of-bounds-access-when-parsing-_cpc-data.patch @@ -0,0 +1,37 @@ +From 40d8abf364bcab23bc715a9221a3c8623956257b Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 22 Mar 2022 17:02:05 +0100 +Subject: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data + +From: Rafael J. Wysocki + +commit 40d8abf364bcab23bc715a9221a3c8623956257b upstream. + +If the NumEntries field in the _CPC return package is less than 2, do +not attempt to access the "Revision" element of that package, because +it may not be present then. + +Fixes: 337aadff8e45 ("ACPI: Introduce CPU performance controls using CPPC") +BugLink: https://lore.kernel.org/lkml/20220322143534.GC32582@xsang-OptiPlex-9020/ +Reported-by: kernel test robot +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Huang Rui +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/cppc_acpi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -681,6 +681,11 @@ int acpi_cppc_processor_probe(struct acp + cpc_obj = &out_obj->package.elements[0]; + if (cpc_obj->type == ACPI_TYPE_INTEGER) { + num_ent = cpc_obj->integer.value; ++ if (num_ent <= 1) { ++ pr_debug("Unexpected _CPC NumEntries value (%d) for CPU:%d\n", ++ num_ent, pr->id); ++ goto out_free; ++ } + } else { + pr_debug("Unexpected entry type(%d) for NumEntries\n", + cpc_obj->type); diff --git a/queue-4.9/series b/queue-4.9/series index d48772c0436..ba296b1ac99 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -152,3 +152,4 @@ ubifs-add-missing-iput-if-do_tmpfile-failed-in-rename-whiteout.patch ubifs-setflags-make-dirtied_ino_d-8-bytes-aligned.patch gfs2-make-sure-fitrim-minlen-is-rounded-up-to-fs-block-size.patch pinctrl-pinconf-generic-print-arguments-for-bias-pull.patch +acpi-cppc-avoid-out-of-bounds-access-when-parsing-_cpc-data.patch