REDHAT-BUG-2348578: Buffer Overflow
In the Linux kernel, the following vulnerability has been resolved:
OPP: add index check to assert to avoid buffer overflow in readfreq()
Pass the freq index to the assert function to make sure we do not read a freq out of the opp->rates[] table when called from the indexed variants: devpmoppfindfreqexactindexed() or devpmoppfindfreqceil/floorindexed().
Add a secondary parameter to the assert function, unused for assertsingleclk() then add assertclkindex() which will check for the clock index when called from the indexed() find functions.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the overflow?
The vulnerable path is reached through the indexed OPP frequency lookup functions: dev_pm_opp_find_freq_exact_indexed(), dev_pm_opp_find_freq_ceil_indexed(), or dev_pm_opp_find_freq_floor_indexed(). An out-of-range frequency index can cause _read_freq() to access beyond the opp->rates[] table.
Which systems or configurations are affected?
The issue is in the Linux kernel OPP subsystem and concerns configurations or drivers that use the indexed OPP frequency lookup variants. The provided information does not identify specific hardware platforms, kernel versions, or default configurations.
What does the fix change?
The fix passes the frequency index into the assertion path and adds an index-specific clock assertion. This prevents _read_freq() from reading a frequency outside the opp->rates[] table when invoked by indexed lookup functions.