[PATCH] PM: EM: allocate the cpumask for every perf domain

[PATCH] PM: EM: allocate the cpumask for every perf domain

[Karl Mehltretter]

em_create_pd() allocates space for the trailing cpus[] flexible array
only for CPU devices.  A performance domain registered for another
device therefore has no storage for its cpumask.

All performance domains are added to em_pd_list.  The netlink interface
does not distinguish CPU and non-CPU domains when it calls
cpumask_weight() or iterates over pd->cpus.  A request for a non-CPU
domain reads cpumask_size() bytes beyond the allocation and can report
bits from the following memory as CPU attributes.

KASAN reports slab-out-of-bounds reads for both dump and by-ID requests
against a synthetic non-CPU performance domain.

GET_PERF_DOMAINS does not require GENL_ADMIN_PERM, so an unprivileged
request can reach this path when a GPU or another devfreq device has
registered an energy model.

Allocate the cpumask for non-CPU domains too.  The zeroed mask remains
empty, as required for the documented unused field.

Fixes: d8eef0453132 ("PM: EM: Implement em_nl_get_pds_doit()")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 kernel/power/energy_model.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c
index e610cf8e9a06..fd07c564c201 100644
--- a/kernel/power/energy_model.c
+++ b/kernel/power/energy_model.c
@@ -439,7 +439,9 @@ static int em_create_pd(struct device *dev, int nr_states,
 
 		cpumask_copy(em_span_cpus(pd), cpus);
 	} else {
-		pd = kzalloc_obj(*pd);
+		/* Readers expect pd->cpus to exist and remain empty. */
+		pd = kzalloc_flex(*pd, cpus,
+				  BITS_TO_LONGS(large_cpumask_bits));
 		if (!pd)
 			return -ENOMEM;
 	}
-- 
2.53.0

Re: [PATCH] PM: EM: allocate the cpumask for every perf domain

[Karl Mehltretter]

On Thu, Sep 10, 2026 at 10:52:34PM +0100, Karl Mehltretter wrote:
> KASAN reports slab-out-of-bounds reads for both dump and by-ID requests
> against a synthetic non-CPU performance domain.
> 
> GET_PERF_DOMAINS does not require GENL_ADMIN_PERM, so an unprivileged
> request can reach this path when a GPU or another devfreq device has
> registered an energy model.
> 
> Allocate the cpumask for non-CPU domains too.  The zeroed mask remains
> empty, as required for the documented unused field.
> 
> Fixes: d8eef0453132 ("PM: EM: Implement em_nl_get_pds_doit()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>

Friendly ping on this patch

Thanks,
Karl