linux-kernel - Re: [PATCH] powercap: dtpm_cpu: Fix NULL pointer dereference race during CPU offlining

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJZ5v0gPfkztEFR5T239VOQErUkxBT35piDZgGi4ZtYBSOO_LQ@mail.gmail.com>
Date: Mon, 30 Jun 2025 22:16:55 +0200
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Elazar Leibovich <elazarl@...ro.ai>
Cc: "Rafael J. Wysocki" <rafael@...nel.org>, Sivan Zohar-Kotzer <sivany32@...il.com>, 
	Daniel Lezcano <daniel.lezcano@...nel.org>, elazarl@...il.com, linux-pm@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] powercap: dtpm_cpu: Fix NULL pointer dereference race
 during CPU offlining

On Sun, Jun 29, 2025 at 12:13 AM Elazar Leibovich <elazarl@...ro.ai> wrote:
>
> On Fri, Jun 27, 2025 at 11:07 PM Rafael J. Wysocki <rafael@...nel.org> wrote:
> > > * DTPM power calculations are triggered (e.g., via sysfs reads) while CPU is online
> > > * The CPU goes offline during the calculation, before em_cpu_get() is called
> > > * em_cpu_get() now returns NULL since the energy model was unregistered
> >
> > But energy models for CPUs are never unregistered.
> >
>
> Can't the following happen (extremely rare, but still):
>
> CPU gets set to impossible during shutdown sequence, e.g.
>
> // arch/alpha/kernel/process.c
> common_shutdown_1(void *generic_ptr)
> ...
>         set_cpu_possible(boot_cpuid, false);
>
> Just before `get_cpu_device` is called by `em_cpu_get`.
> Then `get_cpu_device` returns NULL for impossible CPU, causing
> `em_cpu_get` to return NULL.
>
> It's not a common scenario, but it seems NULL checking doesn't cost much,
> and can assure us no rare case is crashing the system.

It can happen, but in that case (1) the patch changelog is misleading
and (2) the message printed by the new code is not particularly
useful.

Thanks!