diff options
| author | Karl Mehltretter <kmehltretter@gmail.com> | 2026-08-06 07:02:39 +0200 |
|---|---|---|
| committer | Viresh Kumar <viresh.kumar@linaro.org> | 2026-08-06 11:54:41 +0530 |
| commit | 8c3afcf27fa4582c1ab912503dc8a4ebb8dc0f82 (patch) | |
| tree | 7dc63a995884d9e8d0f2c4a40558a4a56e3ba2de /drivers | |
| parent | 22c23c72c3b21fa3ec3db5070dfc0582794e0ef9 (diff) | |
| download | linux-8c3afcf27fa4582c1ab912503dc8a4ebb8dc0f82.tar.gz linux-8c3afcf27fa4582c1ab912503dc8a4ebb8dc0f82.zip | |
cpufreq: imx6q: fix out-of-bounds write when probed more than once
imx6_soc_volt is allocated fresh on every probe, sized to the number of
ARM OPPs:
imx6_soc_volt = devm_kcalloc(cpu_dev, num, sizeof(*imx6_soc_volt),
GFP_KERNEL);
but it is filled through soc_opp_count, which has static storage and is
never reset. A second bind after an unbind keeps indexing from where the
first one stopped, and writes past the end of the new array.
Unbinding and rebinding the driver on qemu's mcimx6ul-evk, under KASAN:
BUG: KASAN: slab-out-of-bounds in imx6q_cpufreq_probe+0x3b0/0xa34
Write of size 4 at addr c5e90480 by task binder/73
imx6q_cpufreq_probe from platform_probe+0x88/0xe4
platform_probe from really_probe+0x108/0x384
bind_store from kernfs_fop_write_iter+0x1b4/0x28c
The write lands one u32 past the end of the allocation.
soc_opp_count is only read a few lines below the loop that fills it, so it
never needed static storage. Make it a local.
Fixes: b4573d1d657a ("cpufreq: imx6q: correct VDDSOC/PU voltage scaling when cpufreq is changed")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/cpufreq/imx6q-cpufreq.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c index 8110c95059e0..731f5721ff1e 100644 --- a/drivers/cpufreq/imx6q-cpufreq.c +++ b/drivers/cpufreq/imx6q-cpufreq.c @@ -55,7 +55,6 @@ static unsigned int max_freq; static unsigned int transition_latency; static u32 *imx6_soc_volt; -static u32 soc_opp_count; static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index) { @@ -330,6 +329,7 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev) const struct property *prop; const __be32 *val; u32 nr, i, j; + u32 soc_opp_count = 0; cpu_dev = get_cpu_device(0); if (!cpu_dev) { |