Re: [PATCH] PM: EM: allocate the cpumask for every perf domain

[Rafael J. Wysocki (Intel)]

On Mon, Oct 12, 2026 at 9:57 AM Lukasz Luba <lukasz.luba@xxxxxxx> wrote:
>
> Hi Karl,
>
> On 9/10/26 21:52, Karl Mehltretter wrote:
> > em_create_pd() allocates space for the trailing cpus[] flexible array
> > only for CPU devices.  A performance domain registered for another
> > device therefore has no storage for its cpumask.
> >
> > All performance domains are added to em_pd_list.  The netlink interface
> > does not distinguish CPU and non-CPU domains when it calls
> > cpumask_weight() or iterates over pd->cpus.  A request for a non-CPU
> > domain reads cpumask_size() bytes beyond the allocation and can report
> > bits from the following memory as CPU attributes.
> >
> > KASAN reports slab-out-of-bounds reads for both dump and by-ID requests
> > against a synthetic non-CPU performance domain.
> >
> > GET_PERF_DOMAINS does not require GENL_ADMIN_PERM, so an unprivileged
> > request can reach this path when a GPU or another devfreq device has
> > registered an energy model.
> >
> > Allocate the cpumask for non-CPU domains too.  The zeroed mask remains
> > empty, as required for the documented unused field.
> >
> > Fixes: d8eef0453132 ("PM: EM: Implement em_nl_get_pds_doit()")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Assisted-by: LLM
> > Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
> > ---
> >   kernel/power/energy_model.c | 4 +++-
> >   1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c
> > index e610cf8e9a06..fd07c564c201 100644
> > --- a/kernel/power/energy_model.c
> > +++ b/kernel/power/energy_model.c
> > @@ -439,7 +439,9 @@ static int em_create_pd(struct device *dev, int nr_states,
> >
> >               cpumask_copy(em_span_cpus(pd), cpus);
> >       } else {
> > -             pd = kzalloc_obj(*pd);
> > +             /* Readers expect pd->cpus to exist and remain empty. */
> > +             pd = kzalloc_flex(*pd, cpus,
> > +                               BITS_TO_LONGS(large_cpumask_bits));
> >               if (!pd)
> >                       return -ENOMEM;
> >       }
>
> my apologies for the delay.
> The patch looks good, thanks for catching this!
>
> Reviewed-by: Lukasz Luba <lukasz.luba@xxxxxxx>

Applied as 7.4-rc material, thanks!