Re: [PATCH] cpufreq: stats: Fix potential out-of-bounds access in deferred reset

[Rafael J. Wysocki (Intel)]

On Tue, Oct 27, 2026 at 2:33 PM Zhongqiu Han
<zhongqiu.han@xxxxxxxxxxxxxxxx> wrote:
>
> cpufreq_stats_create_table() sets stats->last_index to -1 if policy->cur
> is not in the frequency table. It then stays at -1, because
> cpufreq_stats_record_transition() returns early on old_index == -1 before
> it gets to update last_index.
>
> Commit 46a310b80bc2 ("[CPUFREQ] Don't set stat->last_index to -1 if
> the pol->cur has incorrect value.") added that check. However, since
> commit 40c3bd4cfa6f ("cpufreq: stats: Defer stats update to
> cpufreq_stats_record_transition()"), the stats reset is deferred to the
> beginning of cpufreq_stats_record_transition(), before that check, and
> cpufreq_stats_reset_table() ends with an unconditional
> cpufreq_stats_update(). So if the "reset" attribute is written while
> last_index is -1, the next frequency transition accesses
> time_in_state[-1].
>
> Fix it by also returning early on last_index == -1 in
> cpufreq_stats_reset_table().
>
> Fixes: 40c3bd4cfa6f ("cpufreq: stats: Defer stats update to cpufreq_stats_record_transition()")
> Cc: stable@xxxxxxxxxxxxxxx # 5.10+
> Signed-off-by: Zhongqiu Han <zhongqiu.han@xxxxxxxxxxxxxxxx>
> ---
>  drivers/cpufreq/cpufreq_stats.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
> index 670a10c3ecfa..e7ec16bcb67e 100644
> --- a/drivers/cpufreq/cpufreq_stats.c
> +++ b/drivers/cpufreq/cpufreq_stats.c
> @@ -52,6 +52,10 @@ static void cpufreq_stats_reset_table(struct cpufreq_stats *stats)
>          * reset_pending accesses in cpufreq_stats_record_transition().
>          */
>         smp_rmb();
> +
> +       if (stats->last_index == -1)
> +               return;
> +
>         cpufreq_stats_update(stats, READ_ONCE(stats->reset_time));
>  }
>
> --

Applied as 7.4 material, thanks!