projects
/
platform
/
kernel
/
linux-rpi.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
c9b0d25
)
hwmon: (coretemp) Fix out-of-bounds memory access
author
Zhang Rui
<rui.zhang@intel.com>
Fri, 2 Feb 2024 09:21:34 +0000
(17:21 +0800)
committer
Greg Kroah-Hartman
<gregkh@linuxfoundation.org>
Fri, 16 Feb 2024 18:10:49 +0000
(19:10 +0100)
[ Upstream commit
4e440abc894585a34c2904a32cd54af1742311b3
]
Fix a bug that pdata->cpu_map[] is set before out-of-bounds check.
The problem might be triggered on systems with more than 128 cores per
package.
Fixes:
7108b80a542b
("hwmon/coretemp: Handle large core ID value")
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Cc: <stable@vger.kernel.org>
Link:
https://lore.kernel.org/r/20240202092144.71180-2-rui.zhang@intel.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Stable-dep-of:
fdaf0c8629d4
("hwmon: (coretemp) Fix bogus core_id to attr name mapping")
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/hwmon/coretemp.c
patch
|
blob
|
history
diff --git
a/drivers/hwmon/coretemp.c
b/drivers/hwmon/coretemp.c
index
ba82d1e
..
e78c769
100644
(file)
--- a/
drivers/hwmon/coretemp.c
+++ b/
drivers/hwmon/coretemp.c
@@
-509,18
+509,14
@@
static int create_core_data(struct platform_device *pdev, unsigned int cpu,
if (pkg_flag) {
attr_no = PKG_SYSFS_ATTR_NO;
} else {
- index = ida_alloc
(&pdata->ida
, GFP_KERNEL);
+ index = ida_alloc
_max(&pdata->ida, NUM_REAL_CORES - 1
, GFP_KERNEL);
if (index < 0)
return index;
+
pdata->cpu_map[index] = topology_core_id(cpu);
attr_no = index + BASE_SYSFS_ATTR_NO;
}
- if (attr_no > MAX_CORE_DATA - 1) {
- err = -ERANGE;
- goto ida_free;
- }
-
tdata = init_temp_data(cpu, pkg_flag);
if (!tdata) {
err = -ENOMEM;