Commit 0bed9f33 authored by Nikita Kiryushin's avatar Nikita Kiryushin Committed by Xiongfeng Wang
Browse files

ACPI: LPIT: Avoid u32 multiplication overflow 

stable inclusion
from stable-v5.10.209
commit f39c3d578c7d09a18ceaf56750fc7f20b02ada63
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9HZ
CVE: CVE-2023-52683

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f39c3d578c7d09a18ceaf56750fc7f20b02ada63



--------------------------------

[ Upstream commit 56d2eeda87995245300836ee4dbd13b002311782 ]

In lpit_update_residency() there is a possibility of overflow
in multiplication, if tsc_khz is large enough (> UINT_MAX/1000).

Change multiplication to mul_u32_u32().

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: eeb2d80d ("ACPI / LPIT: Add Low Power Idle Table (LPIT) support")
Signed-off-by: default avatarNikita Kiryushin <kiryushin@ancud.ru>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
Signed-off-by: default avatarXiongfeng Wang <wangxiongfeng2@huawei.com>
parent 0d9d0b0a

drivers/acpi/acpi_lpit.c

+1 −1
Original line number Diff line number Diff line
@@ -98,7 +98,7 @@ static void lpit_update_residency(struct lpit_residency_info *info, 
				 struct acpi_lpit_native *lpit_native)

{

	info->frequency = lpit_native->counter_frequency ?

				lpit_native->counter_frequency : tsc_khz * 1000;

				lpit_native->counter_frequency : mul_u32_u32(tsc_khz, 1000U);

	if (!info->frequency)

		info->frequency = 1;