Commit 24e8b394 authored May 15, 2015 by Patrick Daly Committed by Vikram Mulukutla Jul 06, 2015

PM / OPP: Fix potential access to invalid list entry



If struct device_opp has one entry in its opp_list, and a new_opp entry
with a larger rate is added, an unintended memory access occurs.
Fix this issue by only accessing opp->rate when opp->node is a valid list
item.
Discovered with KASAN.

Change-Id: Ib3b75324e349897c25ed7e54ef107700ebdc60c2
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>

parent 96ae61c8

drivers/base/power/opp.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -462,6 +462,9 @@ int dev_pm_opp_add(struct device *dev, unsigned long freq, unsigned long u_volt)
		else
		head = &opp->node;
		}
		/* new_opp is the largest */
		if (&opp->node == &dev_opp->opp_list)
		goto list_add;

		/* Duplicate OPPs ? */
		if (new_opp->rate == opp->rate) {