Re: [PATCH 1/2] platform/x86/intel: power-domains: Handle failed init in tpmi_get_linux_die_id()

[srinivas pandruvada]

On Thu, 2026-09-24 at 12:36 -0700, Kristen Carlson Accardi wrote:
> tpmi_init() returns early with -ENODEV on CPU models that are not in
> tpmi_cpu_ids, before domain_die_map is allocated. When the driver is
> built in, tpmi_get_linux_die_id() remains callable after the failed
> init and dereferences the NULL domain_die_map.
> 
> This is reachable from user space: uncore-frequency-tpmi calls
> tpmi_get_linux_die_id() from the show function of the world-readable
> die_id sysfs attribute. The attribute is created on multi-die
> packages
> for clusters with the core agent type, so reading it on such a CPU
> that is missing from tpmi_cpu_ids oopses.
> 
> Likewise, if cpuhp_setup_state() fails, the error path frees
> domain_die_map but leaves the pointer set, so a later call would read
> freed memory.
> 
> Return -ENODEV when the map was not allocated, and clear the pointer
> wherever it is freed.
> 
> tpmi_get_linux_cpu_number(), tpmi_get_punit_core_number() and
> tpmi_get_power_domain_id() read only the static per-CPU data and hash
> table, so they are safe after a failed init.
> tpmi_get_power_domain_mask()
> has the same problem as this helper but no callers, so it is handled
> separately.
> 
> Fixes: e37be5d85c60 ("platform/x86/intel: power-domains: Add
> interface to get Linux die ID")
> Assisted-by: LLM
> Signed-off-by: Kristen Carlson Accardi <kristen.c.accardi@xxxxxxxxx>

    Acked-by: Srinivas Pandruvada <srinivas.pandruvada@xxxxxxxxxxxxxxx>

> ---
>  drivers/platform/x86/intel/tpmi_power_domains.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/platform/x86/intel/tpmi_power_domains.c
> b/drivers/platform/x86/intel/tpmi_power_domains.c
> index 833052dc34d2..ea51fc56297d 100644
> --- a/drivers/platform/x86/intel/tpmi_power_domains.c
> +++ b/drivers/platform/x86/intel/tpmi_power_domains.c
> @@ -156,6 +156,13 @@ EXPORT_SYMBOL_NS_GPL(tpmi_get_power_domain_mask,
> "INTEL_TPMI_POWER_DOMAIN");
>  
>  int tpmi_get_linux_die_id(int pkg_id, int domain_id)
>  {
> +	/*
> +	 * When built in, this stays callable after tpmi_init()
> failed
> +	 * before allocating the map.
> +	 */
> +	if (!domain_die_map)
> +		return -ENODEV;
> +
>  	if (pkg_id >= topology_max_packages() || domain_id >=
> MAX_POWER_DOMAINS)
>  		return -EINVAL;
>  
> @@ -245,6 +252,7 @@ static int __init tpmi_init(void)
>  
>  free_domain_map:
>  	kfree(domain_die_map);
> +	domain_die_map = NULL;
>  
>  free_domain_mask:
>  	kfree(tpmi_power_domain_mask);
> @@ -258,6 +266,7 @@ static void __exit tpmi_exit(void)
>  	cpuhp_remove_state(tpmi_hp_state);
>  	kfree(tpmi_power_domain_mask);
>  	kfree(domain_die_map);
> +	domain_die_map = NULL;
>  }
>  module_exit(tpmi_exit)
>