From 5f20649ccd2c5fc5236caed1b3da96a0ffe712c8 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Mon, 6 Jan 2025 16:06:04 +0800 Subject: [PATCH] soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() stable inclusion from stable-v4.19.325 commit 37cdd4f0c266560b7b924c42361eeae3dc5f0c3e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGZ CVE: CVE-2024-53158 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=37cdd4f0c266560b7b924c42361eeae3dc5f0c3e -------------------------------- [ Upstream commit 78261cb08f06c93d362cab5c5034bf5899bc7552 ] This loop is supposed to break if the frequency returned from clk_round_rate() is the same as on the previous iteration. However, that check doesn't make sense on the first iteration through the loop. It leads to reading before the start of these->clk_perf_tbl[] array. Fixes: eddac5af0654 ("soc: qcom: Add GENI based QUP Wrapper driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/8cd12678-f44a-4b16-a579-c8f11175ee8c@stanley.mountain Signed-off-by: Bjorn Andersson Signed-off-by: Sasha Levin Signed-off-by: Lin Yujun --- drivers/soc/qcom/qcom-geni-se.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c index ee89ffb6dde8..9ab596183ac3 100644 --- a/drivers/soc/qcom/qcom-geni-se.c +++ b/drivers/soc/qcom/qcom-geni-se.c @@ -529,7 +529,8 @@ int geni_se_clk_tbl_get(struct geni_se *se, unsigned long **tbl) for (i = 0; i < MAX_CLK_PERF_LEVEL; i++) { freq = clk_round_rate(se->clk, freq + 1); - if (freq <= 0 || freq == se->clk_perf_tbl[i - 1]) + if (freq <= 0 || + (i > 0 && freq == se->clk_perf_tbl[i - 1])) break; se->clk_perf_tbl[i] = freq; } -- Gitee