From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 823B63D6488 for ; Fri, 12 Jun 2026 06:25:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781245544; cv=none; b=c6Z6Pq7xTOrCp4I/5/aTykcE75TCM7exGhbREP9xywyn+0wmJv8c/K5QxyAhLJ1Q13trHMt3HrNREg2zF+2Io4t2gD+WHm74yujBxthjkf1XdRdHmlErDHLjOciJyTyMKA+ZM8Ww8gPmQKQ2U5hdet86G+01gDYrXbIbOTn56GM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781245544; c=relaxed/simple; bh=ME6/4at17uE0uQ6UzaFOgHaMMc5xs8aEQfTQpokV1NM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fcWSWHxhxEVM+3y5Ry2yUWsjmcYDNsKEwD7nTN1lIBmCVNFCZP26/3rOo5WO0KfrpTK+n6EGmQVa1jm2pfLR05izZG+TxAv7roxxKlMolb1hmBcXspWiXQWpPhJKuOeEao2dG/Jp9xpmWJ6MYt+21uuhAHbFNuzTgFtmxATGDNE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=soY8tL+2; arc=none smtp.client-ip=209.85.128.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="soY8tL+2" Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4908b92904fso5938015e9.0 for ; Thu, 11 Jun 2026 23:25:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781245541; x=1781850341; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=ER2GZASA5JjD1TFnAJvDRP44OshxUfqSF2ema9VeuQc=; b=soY8tL+22tQUdfGj3eQ6UVoSbb1wbyZ+JOBKF2pkXb0qhKUvUVJp7hMPNNrvYhKxXH KhbDuCo8g7pvf2ChltPHpTS4AG4+HGOC4YY3eaqMXyQooKAecC1GtHK4znx1HrTM4sLT 4Aj6nCd0OEvPatO9mxD4kWYm7y4R7iEb+wb9bzE9Qnj9wfvgafqYwnUuAtp4sTZBxhXi h6S87aLbMr+LW22zHdH/Xd34q8DFbldl+jXiyHjN8vOpcV7nzY1OAeLiho0kKpK7nKBM IchI12XZXI8jwDd6ZoB0UKpaf4aU7X+pqTBY5D16YT7xFj5bL+Tms8zXj31twhaxzS8w BQsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781245541; x=1781850341; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=ER2GZASA5JjD1TFnAJvDRP44OshxUfqSF2ema9VeuQc=; b=ETf73nCo0r+woxKbMkUS4EPM5uKd3is3v52QzMEYkwB/w/ibR0t74D7p7s7qLovdec QXarh9012bwH38LFhvlJwfWoOszlItgZR5JobRipNQwIL064OSIigqdVYU+WS2tk+KtB qMqqA/ZlyO8Lkcf3rOFuaTk6f7lc3ilvO0VrZtV6y4mYiVtZsGKXHdMemAIzw5R+d3w8 IvwI38n2hOJGbCYskM+yCGI/YrxmCxNY66QpUrw+iYvSkzM6EKPNNlONEoOaBNNfJzoU 03WvnDnV6iQnqRCp0JzOdQ/7IL0vG2ZhxVLOfIgrf+paDcOBardb1+v5Nty8u+vwJ+c3 RSmw== X-Forwarded-Encrypted: i=1; AFNElJ+ExuKbmsFyQw12wND9QSHT4smYcXf3pYglGJBD9AHe8QuDKV7x6Cji7Y/YUCfGDbTaEy050MQKO6IvUbk=@vger.kernel.org X-Gm-Message-State: AOJu0YysdZn+996lc+h8GoLR3txUT4DnpC84mNLJFNkX2fB868GcDQxl s6Oq0Ct3J0sjXKv7o7stqxALByJjUrhQ3uVDzWvYbkJKOBPasezmfs8r X-Gm-Gg: Acq92OEMN1+TP0/NJHF5TW8tG5fTV4TglMe3jz8nojvgq2WWeXr5v5FPoGf+GbPdZ/v LPR7LDR7L18dS1BTBGk8tugs3lGX08k7ckMJxXbe6V2xYTFh6uxqSHviB06xPREHcBRWENTPU3P n/lWytrPyrfX93VC9yHLLd9e5zMlMXuEuh3/WeFWb9SiGHtpLemUXLnOGgdGHzfLwAhJ1sFLzfW 834SMOJ2F7e0NIOyIwjdINLVIFWZCHqpOeeG6i/caC8oGLhLKYg12H/aKCSvEy7NelHxJZBPOkK juF1sIxWM5oASCOc/mIAm/vA7wenE3lRmnOhjN/vD2KEsxj68jGxbxq2Yg/5Ea9KkJpq06IhXh0 RHYUh0lDF3xKYbIdeidAn/U2v/i5FpaAiIc5QRpjYTPFZ/+07fKmnh+R1XWxH3ILrF4ee8BVV8c LvvWD5xEIOtH+Gxji13UXVb/0OevbHWQpy56JJPh5QP8/F8YDFfB8Yu1KNGFKv/EG6CZ9NHuEV8 fB8ClPjMSZXWIEh9kyTMhsB79f6NaPdQJAuQ+Dq+inqDQ== X-Received: by 2002:a05:600c:820c:b0:489:5022:39a4 with SMTP id 5b1f17b1804b1-490ec4d652amr14475065e9.9.1781245540476; Thu, 11 Jun 2026 23:25:40 -0700 (PDT) Received: from MBP-Elazar-Leibovich.civet-hops.ts.net (bzq-85-130-200-168.static-ip.bezeqint.net. [85.130.200.168]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-490ea83d8dasm52501375e9.11.2026.06.11.23.25.39 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 11 Jun 2026 23:25:39 -0700 (PDT) From: Elazar Leibovich To: linux-pm@vger.kernel.org Cc: "Rafael J . Wysocki" , Daniel Lezcano , Lukasz Luba , linux-kernel@vger.kernel.org, Elazar Leibovich Subject: [PATCH 0/2] powercap: dtpm: Fix out-of-bounds read in the set_pd_power_limit() callbacks Date: Fri, 12 Jun 2026 09:25:34 +0300 Message-ID: <20260612062536.9147-1-elazarl@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The set_pd_power_limit() callbacks in dtpm_cpu and dtpm_devfreq scan the EM perf state table for the first state whose power exceeds the requested limit, then use table[i - 1]. If the very first perf state already exceeds the limit, the loop breaks at i == 0 and table[-1] is read out of bounds. The powercap core clamps the requested limit to dtpm->power_min, but that clamp can be computed from stale data: in dtpm_cpu the number of online CPUs may have grown since power_min was last updated, and in dtpm_devfreq the EM table may have been updated at runtime via em_dev_update_perf_domain(). In both cases the clamped limit can still be below the first state's power, making the underflow reachable. Start the scan at index 1 so the lowest perf state is used as the fallback when even it exceeds the requested limit. No functional dependency, but minor context offsets assume the dtpm NULL-guard series posted earlier [1]. [1] https://lore.kernel.org/linux-pm/20260611204658.47987-1-elazarl@gmail.com/ Sivan Zohar-Kotzer (2): powercap: dtpm_cpu: Fix out-of-bounds read in set_pd_power_limit() powercap: dtpm_devfreq: Fix out-of-bounds read in set_pd_power_limit() drivers/powercap/dtpm_cpu.c | 2 +- drivers/powercap/dtpm_devfreq.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.50.1 (Apple Git-155)