linux-kernel - [PATCH] PM: EM: Fix NULL pointer dereference in em_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260115103700.177997-1-mrout@redhat.com>
Date: Thu, 15 Jan 2026 16:07:00 +0530
From: Malaya Kumar Rout <mrout@...hat.com>
To: lukasz.luba@....com
Cc: mrout@...hat.com,
	malayarout91@...il.com,
	"Rafael J. Wysocki" <rafael@...nel.org>,
	Len Brown <lenb@...nel.org>,
	Pavel Machek <pavel@...nel.org>,
	linux-pm@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] PM: EM: Fix NULL pointer dereference in em_create_pd()

The get_cpu_device() function can return NULL if the CPU device is
not registered. However, the code in em_create_pd() dereferences the
returned pointer without checking for NULL, which can lead to a kernel
panic during energy model initialization.

Add a NULL check before dereferencing cpu_dev. If get_cpu_device()
returns NULL, return -ENODEV and properly clean up allocated resources
through the existing error path.

This issue was found by code inspection. The same function is correctly
handled with NULL checking in em_cpu_get() at line 555-557.

Fixes: 1bc138c62295 ("PM / EM: add support for other devices than CPUs in Energy Model")
Signed-off-by: Malaya Kumar Rout <mrout@...hat.com>
---
 kernel/power/energy_model.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c
index 11af9f64aa82..3971743d7e67 100644
--- a/kernel/power/energy_model.c
+++ b/kernel/power/energy_model.c
@@ -466,6 +466,10 @@ static int em_create_pd(struct device *dev, int nr_states,
 	if (_is_cpu_device(dev))
 		for_each_cpu(cpu, cpus) {
 			cpu_dev = get_cpu_device(cpu);
+			if (!cpu_dev) {
+				ret = -ENODEV;
+				goto free_pd_table;
+			}
 			cpu_dev->em_pd = pd;
 		}

-- 
2.52.0