Patch "cpufreq: stats: Fix buffer overflow detection in trans_stats()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    cpufreq: stats: Fix buffer overflow detection in trans_stats()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     cpufreq-stats-fix-buffer-overflow-detection-in-trans.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9d11dd94d7935f22ae587f36e54103d22ee89296
Author: Christian Marangi <ansuelsmth@xxxxxxxxx>
Date:   Tue Oct 24 20:30:14 2023 +0200

    cpufreq: stats: Fix buffer overflow detection in trans_stats()
    
    [ Upstream commit ea167a7fc2426f7685c3735e104921c1a20a6d3f ]
    
    Commit 3c0897c180c6 ("cpufreq: Use scnprintf() for avoiding potential
    buffer overflow") switched from snprintf to the more secure scnprintf
    but never updated the exit condition for PAGE_SIZE.
    
    As the commit say and as scnprintf document, what scnprintf returns what
    is actually written not counting the '\0' end char. This results in the
    case of len exceeding the size, len set to PAGE_SIZE - 1, as it can be
    written at max PAGE_SIZE - 1 (as '\0' is not counted)
    
    Because of len is never set to PAGE_SIZE, the function never break early,
    never prints the warning and never return -EFBIG.
    
    Fix this by changing the condition to PAGE_SIZE - 1 to correctly trigger
    the error.
    
    Cc: 5.10+ <stable@xxxxxxxxxxxxxxx> # 5.10+
    Fixes: 3c0897c180c6 ("cpufreq: Use scnprintf() for avoiding potential buffer overflow")
    Signed-off-by: Christian Marangi <ansuelsmth@xxxxxxxxx>
    [ rjw: Subject and changelog edits ]
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index 1570d6f3e75d3..6e57df7a2249f 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -131,25 +131,25 @@ static ssize_t show_trans_table(struct cpufreq_policy *policy, char *buf)
 	len += scnprintf(buf + len, PAGE_SIZE - len, "   From  :    To\n");
 	len += scnprintf(buf + len, PAGE_SIZE - len, "         : ");
 	for (i = 0; i < stats->state_num; i++) {
-		if (len >= PAGE_SIZE)
+		if (len >= PAGE_SIZE - 1)
 			break;
 		len += scnprintf(buf + len, PAGE_SIZE - len, "%9u ",
 				stats->freq_table[i]);
 	}
-	if (len >= PAGE_SIZE)
-		return PAGE_SIZE;
+	if (len >= PAGE_SIZE - 1)
+		return PAGE_SIZE - 1;
 
 	len += scnprintf(buf + len, PAGE_SIZE - len, "\n");
 
 	for (i = 0; i < stats->state_num; i++) {
-		if (len >= PAGE_SIZE)
+		if (len >= PAGE_SIZE - 1)
 			break;
 
 		len += scnprintf(buf + len, PAGE_SIZE - len, "%9u: ",
 				stats->freq_table[i]);
 
 		for (j = 0; j < stats->state_num; j++) {
-			if (len >= PAGE_SIZE)
+			if (len >= PAGE_SIZE - 1)
 				break;
 
 			if (pending)
@@ -159,12 +159,12 @@ static ssize_t show_trans_table(struct cpufreq_policy *policy, char *buf)
 
 			len += scnprintf(buf + len, PAGE_SIZE - len, "%9u ", count);
 		}
-		if (len >= PAGE_SIZE)
+		if (len >= PAGE_SIZE - 1)
 			break;
 		len += scnprintf(buf + len, PAGE_SIZE - len, "\n");
 	}
 
-	if (len >= PAGE_SIZE) {
+	if (len >= PAGE_SIZE - 1) {
 		pr_warn_once("cpufreq transition table exceeds PAGE_SIZE. Disabling\n");
 		return -EFBIG;
 	}