genirq/timings: Prevent potential array overflow in __irq_timings_sto…

…re() commit b9cc7d8 upstream. When the interrupt interval is greater than 2 ^ PREDICTION_BUFFER_SIZE * PREDICTION_FACTOR us and less than 1s, the calculated index will be greater than the length of irqs->ema_time[]. Check the calculated index before using it to prevent array overflow. Fixes: 23aa3b9 ("genirq/timings: Encapsulate storing function") Signed-off-by: Ben Dai <[email protected]> Signed-off-by: Thomas Gleixner <[email protected]> Cc: [email protected] Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
renliguo · Aug 18, 2021 · 2d2c668 · 2d2c668
1 parent 3557541
commit 2d2c668
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/kernel/irq/timings.c b/kernel/irq/timings.c
@@ -453,6 +453,11 @@ static __always_inline void __irq_timings_store(int irq, struct irqt_stat *irqs,
 	 */
 	index = irq_timings_interval_index(interval);
 
+	if (index > PREDICTION_BUFFER_SIZE - 1) {
+		irqs->count = 0;
+		return;
+	}
+
 	/*
 	 * Store the index as an element of the pattern in another
 	 * circular array.