linux/drivers/cpufreq
Zhongqiu Han 8a70298967 cpufreq: stats: Fix potential out-of-bounds access in deferred reset
cpufreq_stats_create_table() sets stats->last_index to -1 if policy->cur
is not in the frequency table. It then stays at -1, because
cpufreq_stats_record_transition() returns early on old_index == -1 before
it gets to update last_index.

Commit 46a310b80b ("[CPUFREQ] Don't set stat->last_index to -1 if
the pol->cur has incorrect value.") added that check. However, since
commit 40c3bd4cfa ("cpufreq: stats: Defer stats update to
cpufreq_stats_record_transition()"), the stats reset is deferred to the
beginning of cpufreq_stats_record_transition(), before that check, and
cpufreq_stats_reset_table() ends with an unconditional
cpufreq_stats_update(). So if the "reset" attribute is written while
last_index is -1, the next frequency transition accesses
time_in_state[-1].

Fix it by also returning early on last_index == -1 in
cpufreq_stats_reset_table().

Fixes: 40c3bd4cfa ("cpufreq: stats: Defer stats update to cpufreq_stats_record_transition()")
Cc: 5.10+ <stable@vger.kernel.org> # 5.10+
Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Link: https://patch.msgid.link/20261027133332.377546-1-zhongqiu.han@oss.qualcomm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-10-27 16:24:22 +01:00
..
acpi-cpufreq.c cpufreq/acpi-cpufreq: Use amd_get_boost_ratio() 2026-10-01 12:55:36 -05:00
airoha-cpufreq.c cpufreq: airoha: fix probe failure with correct error check 2026-08-31 11:01:49 +05:30
amd_freq_sensitivity.c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
amd-pstate-trace.c
amd-pstate-trace.h amd-pstate: Introduce a tracepoint trace_amd_pstate_cppc_req2() 2026-04-02 11:28:31 -05:00
amd-pstate-ut.c cpufreq: amd-pstate-ut: Fix max_freq and EPP test failures on Zen6 2026-10-01 13:05:07 -05:00
amd-pstate.c Merge branch 'pm-cpufreq' 2026-10-19 14:20:58 +02:00
amd-pstate.h cpufreq: amd-pstate-ut: Fix max_freq and EPP test failures on Zen6 2026-10-01 13:05:07 -05:00
apple-soc-cpufreq.c cpufreq: apple-soc: Calculate frequency as a 64-bit value 2026-07-23 09:40:57 +05:30
armada-8k-cpufreq.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
armada-37xx-cpufreq.c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
bmips-cpufreq.c cpufreq: Use %pe to print error pointers symbolically 2026-10-05 09:37:43 +05:30
brcmstb-avs-cpufreq.c cpufreq: brcmstb-avs: Remove redundant dev_err() 2026-07-14 09:40:21 +05:30
cppc_cpufreq.c Merge branch 'pm-cpufreq' 2026-10-19 14:20:58 +02:00
cpufreq_conservative.c cpufreq: conservative: Restrict deferred downscaling to low load 2026-09-17 19:48:55 +02:00
cpufreq_governor_attr_set.c
cpufreq_governor.c cpufreq: conservative: Restrict deferred downscaling to low load 2026-09-17 19:48:55 +02:00
cpufreq_governor.h cpufreq: conservative: Restrict deferred downscaling to low load 2026-09-17 19:48:55 +02:00
cpufreq_ondemand.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cpufreq_ondemand.h
cpufreq_performance.c
cpufreq_powersave.c
cpufreq_stats.c cpufreq: stats: Fix potential out-of-bounds access in deferred reset 2026-10-27 16:24:22 +01:00
cpufreq_userspace.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cpufreq-dt-platdev.c cpufreq: qcom-nvmem: Add IPQ9650 support 2026-10-07 12:38:46 +05:30
cpufreq-dt.c
cpufreq-dt.h
cpufreq-nforce2.c cpufreq: Remove driver default policy->min/max init 2026-06-08 18:42:14 +02:00
cpufreq.c cpufreq: intel_pstate: Fix max_freq fallback in cpufreq_update_pressure() 2026-09-29 12:23:20 +02:00
davinci-cpufreq.c
e_powersaver.c cpufreq: Stop using 32-bit MSR interfaces 2026-07-17 11:31:25 +02:00
freq_table.c cpufreq: Remove driver default policy->min/max init 2026-06-08 18:42:14 +02:00
gx-suspmod.c cpufreq: Remove driver default policy->min/max init 2026-06-08 18:42:14 +02:00
highbank-cpufreq.c
imx-cpufreq-dt.c
imx6q-cpufreq.c cpufreq: imx6q: fix out-of-bounds write when probed more than once 2026-08-06 11:54:41 +05:30
intel_pstate.c cpufreq: intel_pstate: cancel HWP notify work in driver cleanup 2026-10-22 20:55:02 +02:00
Kconfig cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64 2026-10-16 11:12:32 +05:30
Kconfig.arm cpufreq: qcom: Unify user-visible "Qualcomm" name 2026-05-05 08:15:34 +05:30
Kconfig.powerpc
Kconfig.x86 x86/cpu updates for v7.2: 2026-06-15 15:25:17 +05:30
kirkwood-cpufreq.c
longhaul.c cpufreq: Stop using 32-bit MSR interfaces 2026-07-17 11:31:25 +02:00
longhaul.h
longrun.c cpufreq: Stop using 32-bit MSR interfaces 2026-07-17 11:31:25 +02:00
loongson2_cpufreq.c
loongson3_cpufreq.c cpufreq: loongson3: Replace IOCSR read/write with MMIO ones 2026-10-16 11:12:33 +05:30
Makefile cpufreq: elanfreq: Drop support for AMD Elan SC4* 2026-05-22 18:42:19 +02:00
mediatek-cpufreq-hw.c
mediatek-cpufreq.c cpufreq: mediatek: Enter system sleep at the suspend OPP 2026-10-12 09:48:39 +05:30
mvebu-cpufreq.c
p4-clockmod.c x86/msr: Switch wrmsr_on_cpu() users to wrmsrq_on_cpu() 2026-06-08 10:01:49 +02:00
pasemi-cpufreq.c
pcc-cpufreq.c cpufreq: Remove driver default policy->min/max init 2026-06-08 18:42:14 +02:00
pmac32-cpufreq.c
pmac64-cpufreq.c
powernow-k6.c cpufreq: Stop using 32-bit MSR interfaces 2026-07-17 11:31:25 +02:00
powernow-k7.c treewide: Explicitly include the x86 CPUID headers 2026-05-06 14:29:59 +02:00
powernow-k7.h
powernow-k8.c x86/msr updates for v7.3: 2026-08-18 14:02:15 -07:00
powernow-k8.h
powernv-cpufreq.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
powernv-trace.h
pxa2xx-cpufreq.c
pxa3xx-cpufreq.c cpufreq: Remove driver default policy->min/max init 2026-06-08 18:42:14 +02:00
qcom-cpufreq-hw.c cpufreq: qcom-cpufreq-hw: fix device node refcount leak in phandle parsing 2026-10-09 10:02:39 +05:30
qcom-cpufreq-nvmem.c cpufreq: qcom-nvmem: Add IPQ9650 support 2026-10-07 12:38:46 +05:30
qoriq-cpufreq.c cpufreq: Use %pe to print error pointers symbolically 2026-10-05 09:37:43 +05:30
raspberrypi-cpufreq.c
rcpufreq_dt.rs rust: rcpufreq_dt: add module alias 2026-10-05 09:26:03 +05:30
s3c64xx-cpufreq.c cpufreq: Use %pe to print error pointers symbolically 2026-10-05 09:37:43 +05:30
s5pv210-cpufreq.c
sa1110-cpufreq.c
scmi-cpufreq.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
scpi-cpufreq.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
sh-cpufreq.c cpufreq: Remove driver default policy->min/max init 2026-06-08 18:42:14 +02:00
sparc-us2e-cpufreq.c cpufreq: sparc-us2e: fix frequency table index copy-paste error 2026-10-05 09:26:03 +05:30
sparc-us3-cpufreq.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
spear-cpufreq.c cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() 2026-07-15 11:15:13 +05:30
speedstep-centrino.c cpufreq: Stop using 32-bit MSR interfaces 2026-07-17 11:31:25 +02:00
speedstep-ich.c
speedstep-lib.c cpufreq: Stop using 32-bit MSR interfaces 2026-07-17 11:31:25 +02:00
speedstep-lib.h
speedstep-smi.c
sti-cpufreq.c cpufreq: sti: avoid NULL dereference in dev_err() 2026-10-05 09:26:03 +05:30
sun50i-cpufreq-nvmem.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
tegra20-cpufreq.c
tegra124-cpufreq.c
tegra186-cpufreq.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
tegra194-cpufreq.c cpufreq: tegra194: fix double-pointer error in get_cpu_ndiv 2026-10-05 09:26:03 +05:30
ti-cpufreq.c cpufreq: ti: Add EPROBE_DEFER for K3 SoCs 2026-06-08 11:16:42 +05:30
vexpress-spc-cpufreq.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
virtual-cpufreq.c cpufreq: Remove driver default policy->min/max init 2026-06-08 18:42:14 +02:00