Merge tag 'acpi-4.15-rc5' of git://git.kernel.org/pub/scm/linux/kerne…

…l/git/rafael/linux-pm

Pull ACPI fixes from Rafael Wysocki:
 "These fix a recently introduced issue in the ACPI CPPC driver and an
  obscure error hanling bug in the APEI code.

  Specifics:

   - Fix an error handling issue in the ACPI APEI implementation of the
     >read callback in struct pstore_info (Takashi Iwai).

   - Fix a possible out-of-bounds arrar read in the ACPI CPPC driver
     (Colin Ian King)"

* tag 'acpi-4.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: APEI / ERST: Fix missing error handling in erst_reader()
  ACPI: CPPC: remove initial assignment of pcc_ss_data

drivers/acpi/apei/erst.c

@@ -1007,7 +1007,7 @@ static ssize_t erst_reader(struct pstore_record *record)
 	/* The record may be cleared by others, try read next record */
 	if (len == -ENOENT)
 		goto skip;
-	else if (len < sizeof(*rcd)) {
+	else if (len < 0 || len < sizeof(*rcd)) {
 		rc = -EIO;
 		goto out;
 	}

drivers/acpi/cppc_acpi.c

@@ -1171,7 +1171,7 @@ int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)
 	struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);
 	struct cpc_register_resource *desired_reg;
 	int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
-	struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id];
+	struct cppc_pcc_data *pcc_ss_data;
 	int ret = 0;
 
 	if (!cpc_desc || pcc_ss_id < 0) {