[PATCH 0/2] platform/x86/intel: power-domains: Handle failed tpmi_init()

[PATCH 0/2] platform/x86/intel: power-domains: Handle failed tpmi_init()

[Kristen Carlson Accardi]

tpmi_init() can fail before domain_die_map and tpmi_power_domain_mask
are usable. It returns -ENODEV on CPU models that are not in
tpmi_cpu_ids, before allocating them, and if cpuhp_setup_state() fails
it frees them but leaves the pointers set. When the driver is built in,
its exported helpers stay callable after either failure.

Patch 1 fixes tpmi_get_linux_die_id(), which dereferences the NULL map.
uncore-frequency-tpmi calls it when the world-readable die_id sysfs
attribute is read, so on a multi-die CPU missing from tpmi_cpu_ids that
read oopses.

Patch 2 adds the same guard to tpmi_get_power_domain_mask(). It has no
callers in the tree, so this is hardening and carries no Fixes tag.

Both build cleanly with W=1, built in and as a module. Neither has been
runtime-tested on an affected system.

Kristen Carlson Accardi (2):
  platform/x86/intel: power-domains: Handle failed init in
    tpmi_get_linux_die_id()
  platform/x86/intel: power-domains: Handle failed init in
    tpmi_get_power_domain_mask()

 .../platform/x86/intel/tpmi_power_domains.c    | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

-- 
2.55.0

[PATCH 1/2] platform/x86/intel: power-domains: Handle failed init in tpmi_get_linux_die_id()

[Kristen Carlson Accardi]

tpmi_init() returns early with -ENODEV on CPU models that are not in
tpmi_cpu_ids, before domain_die_map is allocated. When the driver is
built in, tpmi_get_linux_die_id() remains callable after the failed
init and dereferences the NULL domain_die_map.

This is reachable from user space: uncore-frequency-tpmi calls
tpmi_get_linux_die_id() from the show function of the world-readable
die_id sysfs attribute. The attribute is created on multi-die packages
for clusters with the core agent type, so reading it on such a CPU
that is missing from tpmi_cpu_ids oopses.

Likewise, if cpuhp_setup_state() fails, the error path frees
domain_die_map but leaves the pointer set, so a later call would read
freed memory.

Return -ENODEV when the map was not allocated, and clear the pointer
wherever it is freed.

tpmi_get_linux_cpu_number(), tpmi_get_punit_core_number() and
tpmi_get_power_domain_id() read only the static per-CPU data and hash
table, so they are safe after a failed init. tpmi_get_power_domain_mask()
has the same problem as this helper but no callers, so it is handled
separately.

Fixes: e37be5d85c60 ("platform/x86/intel: power-domains: Add interface to get Linux die ID")
Assisted-by: LLM
Signed-off-by: Kristen Carlson Accardi <kristen.c.accardi@intel.com>
---
 drivers/platform/x86/intel/tpmi_power_domains.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/platform/x86/intel/tpmi_power_domains.c b/drivers/platform/x86/intel/tpmi_power_domains.c
index 833052dc34d2..ea51fc56297d 100644
--- a/drivers/platform/x86/intel/tpmi_power_domains.c
+++ b/drivers/platform/x86/intel/tpmi_power_domains.c
@@ -156,6 +156,13 @@ EXPORT_SYMBOL_NS_GPL(tpmi_get_power_domain_mask, "INTEL_TPMI_POWER_DOMAIN");
 
 int tpmi_get_linux_die_id(int pkg_id, int domain_id)
 {
+	/*
+	 * When built in, this stays callable after tpmi_init() failed
+	 * before allocating the map.
+	 */
+	if (!domain_die_map)
+		return -ENODEV;
+
 	if (pkg_id >= topology_max_packages() || domain_id >= MAX_POWER_DOMAINS)
 		return -EINVAL;
 
@@ -245,6 +252,7 @@ static int __init tpmi_init(void)
 
 free_domain_map:
 	kfree(domain_die_map);
+	domain_die_map = NULL;
 
 free_domain_mask:
 	kfree(tpmi_power_domain_mask);
@@ -258,6 +266,7 @@ static void __exit tpmi_exit(void)
 	cpuhp_remove_state(tpmi_hp_state);
 	kfree(tpmi_power_domain_mask);
 	kfree(domain_die_map);
+	domain_die_map = NULL;
 }
 module_exit(tpmi_exit)
 
-- 
2.55.0

[PATCH 2/2] platform/x86/intel: power-domains: Handle failed init in tpmi_get_power_domain_mask()

[Kristen Carlson Accardi]

tpmi_init() returns early on CPU models that are not in tpmi_cpu_ids,
before tpmi_power_domain_mask is allocated. When the driver is built
in, the exported tpmi_get_power_domain_mask() remains callable after
the failed init. It returns NULL then only because it indexes the NULL
array at offset 0 for the zeroed per-CPU data. If cpuhp_setup_state()
fails, the error path frees the array but leaves the pointer set, so
the helper would return a pointer into freed memory.

Nothing in the tree calls tpmi_get_power_domain_mask() today, so this
is hardening rather than a fix for a reachable bug. Return NULL when
the array was not allocated, and clear the pointer wherever it is
freed, as the previous patch does for domain_die_map.

Assisted-by: LLM
Signed-off-by: Kristen Carlson Accardi <kristen.c.accardi@intel.com>
---
 drivers/platform/x86/intel/tpmi_power_domains.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/platform/x86/intel/tpmi_power_domains.c b/drivers/platform/x86/intel/tpmi_power_domains.c
index ea51fc56297d..d89b9894c42a 100644
--- a/drivers/platform/x86/intel/tpmi_power_domains.c
+++ b/drivers/platform/x86/intel/tpmi_power_domains.c
@@ -139,6 +139,13 @@ cpumask_t *tpmi_get_power_domain_mask(int cpu_no)
 	cpumask_t *mask;
 	int index;
 
+	/*
+	 * When built in, this stays callable after tpmi_init() failed
+	 * before allocating the array.
+	 */
+	if (!tpmi_power_domain_mask)
+		return NULL;
+
 	if (cpu_no >= num_possible_cpus())
 		return NULL;
 
@@ -256,6 +263,7 @@ static int __init tpmi_init(void)
 
 free_domain_mask:
 	kfree(tpmi_power_domain_mask);
+	tpmi_power_domain_mask = NULL;
 
 	return ret;
 }
@@ -265,6 +273,7 @@ static void __exit tpmi_exit(void)
 {
 	cpuhp_remove_state(tpmi_hp_state);
 	kfree(tpmi_power_domain_mask);
+	tpmi_power_domain_mask = NULL;
 	kfree(domain_die_map);
 	domain_die_map = NULL;
 }
-- 
2.55.0

Re: [PATCH 1/2] platform/x86/intel: power-domains: Handle failed init in tpmi_get_linux_die_id()

[srinivas pandruvada]

On Thu, 2026-09-24 at 12:36 -0700, Kristen Carlson Accardi wrote:
> tpmi_init() returns early with -ENODEV on CPU models that are not in
> tpmi_cpu_ids, before domain_die_map is allocated. When the driver is
> built in, tpmi_get_linux_die_id() remains callable after the failed
> init and dereferences the NULL domain_die_map.
> 
> This is reachable from user space: uncore-frequency-tpmi calls
> tpmi_get_linux_die_id() from the show function of the world-readable
> die_id sysfs attribute. The attribute is created on multi-die
> packages
> for clusters with the core agent type, so reading it on such a CPU
> that is missing from tpmi_cpu_ids oopses.
> 
> Likewise, if cpuhp_setup_state() fails, the error path frees
> domain_die_map but leaves the pointer set, so a later call would read
> freed memory.
> 
> Return -ENODEV when the map was not allocated, and clear the pointer
> wherever it is freed.
> 
> tpmi_get_linux_cpu_number(), tpmi_get_punit_core_number() and
> tpmi_get_power_domain_id() read only the static per-CPU data and hash
> table, so they are safe after a failed init.
> tpmi_get_power_domain_mask()
> has the same problem as this helper but no callers, so it is handled
> separately.
> 
> Fixes: e37be5d85c60 ("platform/x86/intel: power-domains: Add
> interface to get Linux die ID")
> Assisted-by: LLM
> Signed-off-by: Kristen Carlson Accardi <kristen.c.accardi@intel.com>

    Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>

> ---
>  drivers/platform/x86/intel/tpmi_power_domains.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/platform/x86/intel/tpmi_power_domains.c
> b/drivers/platform/x86/intel/tpmi_power_domains.c
> index 833052dc34d2..ea51fc56297d 100644
> --- a/drivers/platform/x86/intel/tpmi_power_domains.c
> +++ b/drivers/platform/x86/intel/tpmi_power_domains.c
> @@ -156,6 +156,13 @@ EXPORT_SYMBOL_NS_GPL(tpmi_get_power_domain_mask,
> "INTEL_TPMI_POWER_DOMAIN");
>  
>  int tpmi_get_linux_die_id(int pkg_id, int domain_id)
>  {
> +	/*
> +	 * When built in, this stays callable after tpmi_init()
> failed
> +	 * before allocating the map.
> +	 */
> +	if (!domain_die_map)
> +		return -ENODEV;
> +
>  	if (pkg_id >= topology_max_packages() || domain_id >=
> MAX_POWER_DOMAINS)
>  		return -EINVAL;
>  
> @@ -245,6 +252,7 @@ static int __init tpmi_init(void)
>  
>  free_domain_map:
>  	kfree(domain_die_map);
> +	domain_die_map = NULL;
>  
>  free_domain_mask:
>  	kfree(tpmi_power_domain_mask);
> @@ -258,6 +266,7 @@ static void __exit tpmi_exit(void)
>  	cpuhp_remove_state(tpmi_hp_state);
>  	kfree(tpmi_power_domain_mask);
>  	kfree(domain_die_map);
> +	domain_die_map = NULL;
>  }
>  module_exit(tpmi_exit)
>  

Re: [PATCH 2/2] platform/x86/intel: power-domains: Handle failed init in tpmi_get_power_domain_mask()

[srinivas pandruvada]

On Thu, 2026-09-24 at 12:36 -0700, Kristen Carlson Accardi wrote:
> tpmi_init() returns early on CPU models that are not in tpmi_cpu_ids,
> before tpmi_power_domain_mask is allocated. When the driver is built
> in, the exported tpmi_get_power_domain_mask() remains callable after
> the failed init. It returns NULL then only because it indexes the
> NULL
> array at offset 0 for the zeroed per-CPU data. If cpuhp_setup_state()
> fails, the error path frees the array but leaves the pointer set, so
> the helper would return a pointer into freed memory.
> 
> Nothing in the tree calls tpmi_get_power_domain_mask() today, so this
> is hardening rather than a fix for a reachable bug. Return NULL when
> the array was not allocated, and clear the pointer wherever it is
> freed, as the previous patch does for domain_die_map.
> 
> Assisted-by: LLM
> Signed-off-by: Kristen Carlson Accardi <kristen.c.accardi@intel.com>

    Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>

> ---
>  drivers/platform/x86/intel/tpmi_power_domains.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/platform/x86/intel/tpmi_power_domains.c
> b/drivers/platform/x86/intel/tpmi_power_domains.c
> index ea51fc56297d..d89b9894c42a 100644
> --- a/drivers/platform/x86/intel/tpmi_power_domains.c
> +++ b/drivers/platform/x86/intel/tpmi_power_domains.c
> @@ -139,6 +139,13 @@ cpumask_t *tpmi_get_power_domain_mask(int
> cpu_no)
>  	cpumask_t *mask;
>  	int index;
>  
> +	/*
> +	 * When built in, this stays callable after tpmi_init()
> failed
> +	 * before allocating the array.
> +	 */
> +	if (!tpmi_power_domain_mask)
> +		return NULL;
> +
>  	if (cpu_no >= num_possible_cpus())
>  		return NULL;
>  
> @@ -256,6 +263,7 @@ static int __init tpmi_init(void)
>  
>  free_domain_mask:
>  	kfree(tpmi_power_domain_mask);
> +	tpmi_power_domain_mask = NULL;
>  
>  	return ret;
>  }
> @@ -265,6 +273,7 @@ static void __exit tpmi_exit(void)
>  {
>  	cpuhp_remove_state(tpmi_hp_state);
>  	kfree(tpmi_power_domain_mask);
> +	tpmi_power_domain_mask = NULL;
>  	kfree(domain_die_map);
>  	domain_die_map = NULL;
>  }