From patchwork Mon Oct 17 15:14:56 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sergey Senozhatsky X-Patchwork-Id: 9379601 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7D1B3608A7 for ; Mon, 17 Oct 2016 15:16:10 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6C8D228854 for ; Mon, 17 Oct 2016 15:16:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6123428A19; Mon, 17 Oct 2016 15:16:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E43B9289FB for ; Mon, 17 Oct 2016 15:16:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934873AbcJQPQE (ORCPT ); Mon, 17 Oct 2016 11:16:04 -0400 Received: from mail-pf0-f195.google.com ([209.85.192.195]:33603 "EHLO mail-pf0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933594AbcJQPQD (ORCPT ); Mon, 17 Oct 2016 11:16:03 -0400 Received: by mail-pf0-f195.google.com with SMTP id i85so9561141pfa.0; Mon, 17 Oct 2016 08:16:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=cBFe7kAhlmeiCrF1nmLR2PW6pbe9eDTsjRf10AnxmaA=; b=S3Z+DjHddsYFYZJYN0RC7dxngPKZyqqZ3GX4n32O4/Hdvan96oLR8rAMLIDvvTLR+a nQGIF+BKFc4hXKK/u7qvyU91G8vULER+5/80wiHAn5ofQkQmASPEG6N1215H9WJNybJ5 ASjZh4sINcp7WUUono/UW8m57t7GStM3pbLhk/D4WcGhRKnGw4t2IK+/tdEYdb1WjvW5 Or5W80PI0XVq2xHZim2gTcgnW0EqW1OknZKfm+dr+IOQwFrKXPbGN0fLroYJknxhpBjZ ixio3XAJI2xT2quL9mCRhziEZmqlGf+TmY0ZuXx9ygUPYike6RolfHSG0PfChRMPG4nH 52vA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=cBFe7kAhlmeiCrF1nmLR2PW6pbe9eDTsjRf10AnxmaA=; b=FuK0ZBTEMlopx9c0XZZ86ifjI5KSu5YJ8PfVyo4KzbGgfCvBswFFJJnCStJu2RKzjC PFP6lfU+4i2Ub04uOCuBOvFZpDJG4vNajLL1qBO5sXcawTTg+qDJ4f1Omv0oO3cktFEf XsdPs3xqRilOmSO74jUe+LAJLZ2JU6Emfve1i62iV4CnsX483hW0/1ETarqgy0NGObqe 64QPIhLzDRLuzBX2qev4ACH4lMsmXPRnoTnG+BTD4UAZTDmTjjg/fnLwgWZ9/Njw1F+f fFgRrStYWEJNZ1jrdlgthYMuNFWniAoXgiGGvEVxNCJu5DqhbWgkD9hwpBP1982AjoG4 h6Og== X-Gm-Message-State: AA6/9RljMIvuicDS3UBZg6oCpNrssX6szk9v7CnmN7G/Er8PK2FgQfigNzqtfqEMVvdR3Q== X-Received: by 10.99.110.14 with SMTP id j14mr32021171pgc.135.1476717362226; Mon, 17 Oct 2016 08:16:02 -0700 (PDT) Received: from localhost.localdomain ([112.168.75.135]) by smtp.gmail.com with ESMTPSA id e6sm48938572pfb.57.2016.10.17.08.15.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 17 Oct 2016 08:16:01 -0700 (PDT) From: Sergey Senozhatsky To: "Rafael J . Wysocki" Cc: Viresh Kumar , Aaro Koskinen , linux-pm@vger.kernel.org, linux-kernel@vger.kernel.org, Sergey Senozhatsky , Sergey Senozhatsky Subject: [PATCH] cpufreq: fix overflow in cpufreq_table_find_index_dl() Date: Tue, 18 Oct 2016 00:14:56 +0900 Message-Id: <20161017151456.3573-1-sergey.senozhatsky@gmail.com> X-Mailer: git-send-email 2.10.1.382.ga23ca1b Sender: linux-pm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP 'best' is always less or equals to 'pos', so `best - pos' returns a negative value which is then getting casted to `unsigned int' and passed to __cpufreq_driver_target()->acpi_cpufreq_target() for policy->freq_table election. This results in: BUG: unable to handle kernel paging request at ffff881019b469f8 IP: [] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq] PGD 267f067 PUD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 6 PID: 70 Comm: kworker/6:1 Not tainted 4.9.0-rc1-next-20161017 Workqueue: events dbs_work_handler task: ffff88041b808000 task.stack: ffff88041b810000 RIP: 0010:[] [] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq] RSP: 0018:ffff88041b813c60 EFLAGS: 00010282 RAX: ffff880419b46a00 RBX: ffff88041b848400 RCX: ffff880419b20f80 RDX: 00000000001dff38 RSI: 00000000ffffffff RDI: ffff88041b848400 RBP: ffff88041b813cb0 R08: 0000000000000006 R09: 0000000000000040 R10: ffffffff8207f9e0 R11: ffffffff8173595b R12: 0000000000000000 R13: ffff88041f1dff38 R14: 0000000000262900 R15: 0000000bfffffff4 FS: 0000000000000000(0000) GS:ffff88041f000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff881019b469f8 CR3: 000000041a2d3000 CR4: 00000000001406e0 Stack: ffff88041b813cb0 ffffffff813347f9 ffff88041b813ca0 ffffffff81334663 ffff88041f1d4bc0 ffff88041b848400 0000000000000000 0000000000000000 0000000000262900 0000000000000000 ffff88041b813d00 ffffffff813355dc Call Trace: [] ? cpufreq_freq_transition_begin+0xf1/0xfc [] ? get_cpu_idle_time+0x97/0xa6 [] __cpufreq_driver_target+0x3b6/0x44e [] cs_dbs_timer+0x11a/0x135 [] dbs_work_handler+0x39/0x62 [] process_one_work+0x280/0x4a5 [] worker_thread+0x24f/0x397 [] ? rescuer_thread+0x30b/0x30b [] ? nl80211_get_key+0x29/0x36a [] kthread+0xfc/0x104 [] ? put_lock_stats.isra.9+0xe/0x20 [] ? kthread_create_on_node+0x3f/0x3f [] ret_from_fork+0x22/0x30 Code: 56 4d 6b ff 0c 41 55 41 54 53 48 83 ec 28 48 8b 15 ad 1e 00 00 44 8b 41 08 48 8b 87 c8 00 00 00 49 89 d5 4e 03 2c c5 80 b2 78 81 <46> 8b 74 38 04 45 3b 75 00 75 11 31 c0 83 39 00 0f 84 1c 01 00 RIP [] acpi_cpufreq_target+0x4f/0x190 [acpi_cpufreq] RSP CR2: ffff881019b469f8 ---[ end trace 16d9fc7a17897d37 ]--- Signed-off-by: Sergey Senozhatsky --- include/linux/cpufreq.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 5fa55fc..2a7aa0b 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -677,10 +677,10 @@ static inline int cpufreq_table_find_index_dl(struct cpufreq_policy *policy, if (best == table - 1) return pos - table; - return best - pos; + return pos - best; } - return best - pos; + return pos - best; } /* Works only on sorted freq-tables */