power: check frequencies count before filling array

The freqs array size is RTE_MAX_LCORE_FREQS. Before filling the
array with num_freqs elements, restrict the total num to
RTE_MAX_LCORE_FREQS. This fix aims to fix the coverity scan issue
like:
Overrunning array "pi->freqs" of 256 bytes by passing it to a
function which accesses it at byte offset 464.

Coverity issue: 371913
Fixes: ef1cc88f1837 ("power: support cppc_cpufreq driver")
Cc: stable@dpdk.org
Signed-off-by: Richael Zhuang <richael.zhuang@arm.com>
Acked-by: David Hunt <david.hunt@intel.com>

diff --git a/lib/power/power_cppc_cpufreq.c b/lib/power/power_cppc_cpufreq.c
index e92973ab54103ba5ac6e7de3dc6be7dd5314ca8b..6afd310e4ee4cae21a980fbe988158ee722ec9d8 100644 (file)
--- a/lib/power/power_cppc_cpufreq.c
+++ b/lib/power/power_cppc_cpufreq.c
@@ -246,6 +246,11 @@ power_get_available_freqs(struct cppc_power_info *pi)
                        pi->nominal_perf * UNIT_DIFF : pi->nominal_perf;
        num_freqs = (nominal_perf - scaling_min_freq) / BUS_FREQ + 1 +
                pi->turbo_available;
+       if (num_freqs >= RTE_MAX_LCORE_FREQS) {
+               RTE_LOG(ERR, POWER, "Too many available frequencies: %d\n",
+                               num_freqs);
+               goto out;
+       }
 
        /* Generate the freq bucket array. */
        for (i = 0, pi->nb_freqs = 0; i < num_freqs; i++) {

diff --git a/lib/power/power_pstate_cpufreq.c b/lib/power/power_pstate_cpufreq.c
index 3b607515fd071aecd945ec04b052dbe254b1f783..86f8a76e46622433b745c8afadb4fbe7b0d88fd8 100644 (file)
--- a/lib/power/power_pstate_cpufreq.c
+++ b/lib/power/power_pstate_cpufreq.c
@@ -419,6 +419,11 @@ power_get_available_freqs(struct pstate_power_info *pi)
         */
        num_freqs = (base_max_freq - sys_min_freq) / BUS_FREQ + 1 +
                pi->turbo_available;
+       if (num_freqs >= RTE_MAX_LCORE_FREQS) {
+               RTE_LOG(ERR, POWER, "Too many available frequencies: %d\n",
+                               num_freqs);
+               goto out;
+       }
 
        /* Generate the freq bucket array.
         * If turbo is available the freq bucket[0] value is base_max +1