Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-25 13:41:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

tools/power/x86/intel-speed-select: Fix a read overflow in isst_set_tdp_level_msr()

Browse Source 
The isst_send_msr_command() function will read 8 bytes but we are
passing an address to an int (4 bytes) so it results in a read overflow.

Fixes: 3fb4f7cd47 ("tools/power/x86: A tool to validate Intel Speed Select commands")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
This commit is contained in:
Dan Carpenter 2019-08-21 10:14:03 +03:00 committed by Andy Shevchenko
parent 0ecee9e3d4
commit 010764b885
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/power/x86/intel-speed-select/isst-core.c
View File

@ -190,6 +190,7 @@ int isst_get_get_trl(int cpu, int level, int avx_level, int *trl)
int isst_set_tdp_level_msr(int cpu, int tdp_level)
{
unsigned long long level = tdp_level;
int ret;
debug_printf("cpu: tdp_level via MSR %d\n", cpu, tdp_level);
@ -202,8 +203,7 @@ int isst_set_tdp_level_msr(int cpu, int tdp_level)
if (tdp_level > 2)
return -1; /* invalid value */
ret = isst_send_msr_command(cpu, 0x64b, 1,
(unsigned long long *)&tdp_level);
ret = isst_send_msr_command(cpu, 0x64b, 1, &level);
if (ret)
return ret;