linux-kernel - [PATCH] powercap: dtpm_cpu: Fix NULL pointer dereference race during CPU offlining

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250618231632.113471-1-sivany32@gmail.com>
Date: Thu, 19 Jun 2025 02:16:31 +0300
From: Sivan Zohar-Kotzer <sivany32@...il.com>
To: Daniel Lezcano <daniel.lezcano@...nel.org>,
	"Rafael J . Wysocki" <rafael@...nel.org>
Cc: elazarl@...il.com,
	linux-pm@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Sivan Zohar-Kotzer <sivany32@...il.com>
Subject: [PATCH] powercap: dtpm_cpu: Fix NULL pointer dereference race during CPU offlining

The get_pd_power_uw() function contains a race condition during CPU
offlining:

* DTPM power calculations are triggered (e.g., via sysfs reads) while CPU is online
* The CPU goes offline during the calculation, before em_cpu_get() is called
* em_cpu_get() now returns NULL since the energy model was unregistered
* em_span_cpus() dereferences the NULL pointer, causing a crash

Commit eb82bace8931 introduced the call to em_span_cpus(pd) without
checking if pd is NULL.

Add a NULL check after em_cpu_get() and return 0 power if no energy model
is available, matching the existing fallback behavior.

Fixes: eb82bace8931 ("powercap/drivers/dtpm: Scale the power with the load")
Signed-off-by: Sivan Zohar-Kotzer <sivany32@...il.com>
---
 drivers/powercap/dtpm_cpu.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/powercap/dtpm_cpu.c b/drivers/powercap/dtpm_cpu.c
index 6b6f51b21550..80d93ab4dc54 100644
--- a/drivers/powercap/dtpm_cpu.c
+++ b/drivers/powercap/dtpm_cpu.c
@@ -97,6 +97,11 @@ static u64 get_pd_power_uw(struct dtpm *dtpm)
 
 	pd = em_cpu_get(dtpm_cpu->cpu);
 
+	if (!pd) {
+		pr_warn("DTPM: No energy model available for CPU%d\n", dtpm_cpu->cpu);
+		return 0;
+	}
+
 	pd_mask = em_span_cpus(pd);
 
 	freq = cpufreq_quick_get(dtpm_cpu->cpu);
@@ -207,6 +212,7 @@ static int __dtpm_cpu_setup(int cpu, struct dtpm *parent)
 	pd = em_cpu_get(cpu);
 	if (!pd || em_is_artificial(pd)) {
 		ret = -EINVAL;
+
 		goto release_policy;
 	}
 
-- 
2.45.2