Commit 78d10740 authored by Dan Carpenter's avatar Dan Carpenter Committed by dinglongwei
Browse files

powercap: intel_rapl: Fix off by one in get_rpi() 

stable inclusion
from stable-v6.6.54
commit 288cbc505e2046638c615c36357cb78bc9fee1e0
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQOY
CVE: CVE-2024-49862

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=288cbc505e2046638c615c36357cb78bc9fee1e0



--------------------------------

[ Upstream commit 95f6580352a7225e619551febb83595bcb77ab17 ]

The rp->priv->rpi array is either rpi_msr or rpi_tpmi which have
NR_RAPL_PRIMITIVES number of elements.  Thus the > needs to be >=
to prevent an off by one access.

Fixes: 98ff639a ("powercap: intel_rapl: Support per Interface primitive information")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Acked-by: default avatarZhang Rui <rui.zhang@intel.com>
Link: https://patch.msgid.link/86e3a059-504d-4795-a5ea-4a653f3b41f8@stanley.mountain


Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatardinglongwei <dinglongwei1@huawei.com>
parent 41255614

drivers/powercap/intel_rapl_common.c

+1 −1
Original line number Diff line number Diff line
@@ -737,7 +737,7 @@ static struct rapl_primitive_info *get_rpi(struct rapl_package *rp, int prim) 
{

	struct rapl_primitive_info *rpi = rp->priv->rpi;



	if (prim < 0 || prim > NR_RAPL_PRIMITIVES || !rpi)

	if (prim < 0 || prim >= NR_RAPL_PRIMITIVES || !rpi)

		return NULL;



	return &rpi[prim];