From mboxrd@z Thu Jan 1 00:00:00 1970 From: Viresh Kumar Subject: Re: [PATCHv2] cpufreq: fix overflow in cpufreq_table_find_index_dl() Date: Tue, 18 Oct 2016 12:07:18 +0530 Message-ID: <20161018063718.GN2991@vireshk-i7> References: <20161017151456.3573-1-sergey.senozhatsky@gmail.com> <20161017154112.1111-1-sergey.senozhatsky@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from mail-pf0-f171.google.com ([209.85.192.171]:34398 "EHLO mail-pf0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750761AbcJRGhX (ORCPT ); Tue, 18 Oct 2016 02:37:23 -0400 Received: by mail-pf0-f171.google.com with SMTP id r16so65455131pfg.1 for ; Mon, 17 Oct 2016 23:37:23 -0700 (PDT) Content-Disposition: inline In-Reply-To: <20161017154112.1111-1-sergey.senozhatsky@gmail.com> Sender: linux-pm-owner@vger.kernel.org List-Id: linux-pm@vger.kernel.org To: Sergey Senozhatsky Cc: "Rafael J . Wysocki" , Aaro Koskinen , linux-pm@vger.kernel.org, linux-kernel@vger.kernel.org, Sergey Senozhatsky On 18-10-16, 00:41, Sergey Senozhatsky wrote: > 'best' is always less or equals to 'pos', so `best - pos' returns > a negative value which is then getting casted to `unsigned int' > and passed to __cpufreq_driver_target()->acpi_cpufreq_target() > for policy->freq_table selection. This results in > > BUG: unable to handle kernel paging request at ffff881019b469f8 > IP: [] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq] > PGD 267f067 > PUD 0 > > Oops: 0000 [#1] PREEMPT SMP > CPU: 6 PID: 70 Comm: kworker/6:1 Not tainted 4.9.0-rc1-next-20161017-dbg-dirty > Workqueue: events dbs_work_handler > task: ffff88041b808000 task.stack: ffff88041b810000 > RIP: 0010:[] [] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq] > RSP: 0018:ffff88041b813c60 EFLAGS: 00010282 > RAX: ffff880419b46a00 RBX: ffff88041b848400 RCX: ffff880419b20f80 > RDX: 00000000001dff38 RSI: 00000000ffffffff RDI: ffff88041b848400 > RBP: ffff88041b813cb0 R08: 0000000000000006 R09: 0000000000000040 > R10: ffffffff8207f9e0 R11: ffffffff8173595b R12: 0000000000000000 > R13: ffff88041f1dff38 R14: 0000000000262900 R15: 0000000bfffffff4 > FS: 0000000000000000(0000) GS:ffff88041f000000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: ffff881019b469f8 CR3: 000000041a2d3000 CR4: 00000000001406e0 > Stack: > ffff88041b813cb0 ffffffff813347f9 ffff88041b813ca0 ffffffff81334663 > ffff88041f1d4bc0 ffff88041b848400 0000000000000000 0000000000000000 > 0000000000262900 0000000000000000 ffff88041b813d00 ffffffff813355dc > Call Trace: > [] ? cpufreq_freq_transition_begin+0xf1/0xfc > [] ? get_cpu_idle_time+0x97/0xa6 > [] __cpufreq_driver_target+0x3b6/0x44e > [] cs_dbs_timer+0x11a/0x135 > [] dbs_work_handler+0x39/0x62 > [] process_one_work+0x280/0x4a5 > [] worker_thread+0x24f/0x397 > [] ? rescuer_thread+0x30b/0x30b > [] ? nl80211_get_key+0x29/0x36a > [] kthread+0xfc/0x104 > [] ? put_lock_stats.isra.9+0xe/0x20 > [] ? kthread_create_on_node+0x3f/0x3f > [] ret_from_fork+0x22/0x30 > Code: 56 4d 6b ff 0c 41 55 41 54 53 48 83 ec 28 48 8b 15 ad 1e 00 00 44 8b 41 > 08 48 8b 87 c8 00 00 00 49 89 d5 4e 03 2c c5 80 b2 78 81 <46> 8b 74 38 04 45 > 3b 75 00 75 11 31 c0 83 39 00 0f 84 1c 01 00 > RIP [] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq] > RSP > CR2: ffff881019b469f8 > ---[ end trace 16d9fc7a17897d37 ]--- > > Signed-off-by: Sergey Senozhatsky > --- > include/linux/cpufreq.h | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h > index 5fa55fc..32dc0cbd 100644 > --- a/include/linux/cpufreq.h > +++ b/include/linux/cpufreq.h > @@ -677,10 +677,10 @@ static inline int cpufreq_table_find_index_dl(struct cpufreq_policy *policy, > if (best == table - 1) > return pos - table; > > - return best - pos; > + return best - table; > } > > - return best - pos; > + return best - table; > } > Acked-by: Viresh Kumar -- viresh