[PATCH 0/2] powercap: dtpm: Fix out-of-bounds read in the set_pd_power_limit() callbacks

[Elazar Leibovich]

The set_pd_power_limit() callbacks in dtpm_cpu and dtpm_devfreq scan
the EM perf state table for the first state whose power exceeds the
requested limit, then use table[i - 1]. If the very first perf state
already exceeds the limit, the loop breaks at i == 0 and table[-1] is
read out of bounds.

The powercap core clamps the requested limit to dtpm->power_min, but
that clamp can be computed from stale data: in dtpm_cpu the number of
online CPUs may have grown since power_min was last updated, and in
dtpm_devfreq the EM table may have been updated at runtime via
em_dev_update_perf_domain(). In both cases the clamped limit can still
be below the first state's power, making the underflow reachable.

Start the scan at index 1 so the lowest perf state is used as the
fallback when even it exceeds the requested limit.

No functional dependency, but minor context offsets assume the dtpm
NULL-guard series posted earlier [1].

[1] https://lore.kernel.org/linux-pm/20260611204658.47987-1-elazarl@xxxxxxxxx/

Sivan Zohar-Kotzer (2):
  powercap: dtpm_cpu: Fix out-of-bounds read in set_pd_power_limit()
  powercap: dtpm_devfreq: Fix out-of-bounds read in set_pd_power_limit()

 drivers/powercap/dtpm_cpu.c     | 2 +-
 drivers/powercap/dtpm_devfreq.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

-- 
2.50.1 (Apple Git-155)