github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

PM: EM: allocate the cpumask for every perf domain

Browse Source 
em_create_pd() allocates space for the trailing cpus[] flexible array
only for CPU devices.  A performance domain registered for another
device therefore has no storage for its cpumask.

All performance domains are added to em_pd_list.  The netlink interface
does not distinguish CPU and non-CPU domains when it calls
cpumask_weight() or iterates over pd->cpus.  A request for a non-CPU
domain reads cpumask_size() bytes beyond the allocation and can report
bits from the following memory as CPU attributes.

KASAN reports slab-out-of-bounds reads for both dump and by-ID requests
against a synthetic non-CPU performance domain.

GET_PERF_DOMAINS does not require GENL_ADMIN_PERM, so an unprivileged
request can reach this path when a GPU or another devfreq device has
registered an energy model.

Allocate the cpumask for non-CPU domains too.  The zeroed mask remains
empty, as required for the documented unused field.

Fixes: d8eef04531 ("PM: EM: Implement em_nl_get_pds_doit()")
Cc: All Applicable <stable@vger.kernel.org>
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
Link: https://patch.msgid.link/20260910205234.5392-1-kmehltretter@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit is contained in:
Karl Mehltretter 2026-09-10 22:52:34 +02:00 committed by Rafael J. Wysocki
parent 7be4bc52fd
commit 6c7a7007c5
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
kernel/power/energy_model.c
View File

@ -439,7 +439,9 @@ static int em_create_pd(struct device *dev, int nr_states,
cpumask_copy(em_span_cpus(pd), cpus);
} else {
pd = kzalloc_obj(*pd);
/* Readers expect pd->cpus to exist and remain empty. */
pd = kzalloc_flex(*pd, cpus,
BITS_TO_LONGS(large_cpumask_bits));
if (!pd)
return -ENOMEM;
}