Re: [PATCH] PM: EM: allocate the cpumask for every perf domain

[Lukasz Luba <lukasz.luba@arm.com>]

Hi Karl,

On 9/10/26 21:52, Karl Mehltretter wrote:
> em_create_pd() allocates space for the trailing cpus[] flexible array
> only for CPU devices.  A performance domain registered for another
> device therefore has no storage for its cpumask.
> 
> All performance domains are added to em_pd_list.  The netlink interface
> does not distinguish CPU and non-CPU domains when it calls
> cpumask_weight() or iterates over pd->cpus.  A request for a non-CPU
> domain reads cpumask_size() bytes beyond the allocation and can report
> bits from the following memory as CPU attributes.
> 
> KASAN reports slab-out-of-bounds reads for both dump and by-ID requests
> against a synthetic non-CPU performance domain.
> 
> GET_PERF_DOMAINS does not require GENL_ADMIN_PERM, so an unprivileged
> request can reach this path when a GPU or another devfreq device has
> registered an energy model.
> 
> Allocate the cpumask for non-CPU domains too.  The zeroed mask remains
> empty, as required for the documented unused field.
> 
> Fixes: d8eef0453132 ("PM: EM: Implement em_nl_get_pds_doit()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
>   kernel/power/energy_model.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c
> index e610cf8e9a06..fd07c564c201 100644
> --- a/kernel/power/energy_model.c
> +++ b/kernel/power/energy_model.c
> @@ -439,7 +439,9 @@ static int em_create_pd(struct device *dev, int nr_states,
>   
>   		cpumask_copy(em_span_cpus(pd), cpus);
>   	} else {
> -		pd = kzalloc_obj(*pd);
> +		/* Readers expect pd->cpus to exist and remain empty. */
> +		pd = kzalloc_flex(*pd, cpus,
> +				  BITS_TO_LONGS(large_cpumask_bits));
>   		if (!pd)
>   			return -ENOMEM;
>   	}

my apologies for the delay.
The patch looks good, thanks for catching this!

Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>