From f50b7905f0b6d9f49c2a3e067bd92566e4ff3bfc Mon Sep 17 00:00:00 2001 From: Jinjie Ruan Date: Sat, 28 Dec 2024 06:49:45 +0000 Subject: [PATCH 1/2] cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() stable inclusion from stable-v6.6.64 commit f05ef81db63889f6f14eb77fd140dac6cedb6f7f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFH CVE: CVE-2024-53230 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f05ef81db63889f6f14eb77fd140dac6cedb6f7f -------------------------------- [ Upstream commit 1a1374bb8c5926674973d849feed500bc61ad535 ] cpufreq_cpu_get_raw() may return NULL if the cpu is not in policy->cpus cpu mask and it will cause null pointer dereference, so check NULL for cppc_get_cpu_cost(). Fixes: 740fcdc2c20e ("cpufreq: CPPC: Register EM based on efficiency class information") Signed-off-by: Jinjie Ruan Signed-off-by: Viresh Kumar Signed-off-by: Sasha Levin Signed-off-by: Jinjie Ruan --- drivers/cpufreq/cppc_cpufreq.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c index d67fca167d8b..b2903a80d34d 100644 --- a/drivers/cpufreq/cppc_cpufreq.c +++ b/drivers/cpufreq/cppc_cpufreq.c @@ -498,6 +498,9 @@ static int cppc_get_cpu_cost(struct device *cpu_dev, unsigned long KHz, int step; policy = cpufreq_cpu_get_raw(cpu_dev->id); + if (!policy) + return 0; + cpu_data = policy->driver_data; perf_caps = &cpu_data->perf_caps; max_cap = arch_scale_cpu_capacity(cpu_dev->id); -- Gitee From 1bad72d6ab8a2470376e668f8468742b0cf5df48 Mon Sep 17 00:00:00 2001 From: Jinjie Ruan Date: Sat, 28 Dec 2024 06:49:46 +0000 Subject: [PATCH 2/2] cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost() stable inclusion from stable-v6.6.64 commit 4989d1ccf6f1c5691d5b8d87a0aed8e1ffe17b3c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFH CVE: CVE-2024-53230 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4989d1ccf6f1c5691d5b8d87a0aed8e1ffe17b3c -------------------------------- [ Upstream commit be392aa80f1e5b0b65ccc2a540b9304fefcfe3d8 ] cppc_get_cpu_cost() return 0 if the policy is NULL. Then in em_compute_costs(), the later zero check for cost is not valid as cost is uninitialized. As Quentin pointed out, kernel energy model core check the return value of get_cost() first, so if the callback failed it should tell the core. Return -EINVAL to fix it. Fixes: 1a1374bb8c59 ("cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/c4765377-7830-44c2-84fa-706b6e304e10@stanley.mountain/ Signed-off-by: Jinjie Ruan Suggested-by: Quentin Perret Signed-off-by: Viresh Kumar Signed-off-by: Sasha Levin Signed-off-by: Jinjie Ruan --- drivers/cpufreq/cppc_cpufreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c index b2903a80d34d..387fc2f984ce 100644 --- a/drivers/cpufreq/cppc_cpufreq.c +++ b/drivers/cpufreq/cppc_cpufreq.c @@ -499,7 +499,7 @@ static int cppc_get_cpu_cost(struct device *cpu_dev, unsigned long KHz, policy = cpufreq_cpu_get_raw(cpu_dev->id); if (!policy) - return 0; + return -EINVAL; cpu_data = policy->driver_data; perf_caps = &cpu_data->perf_caps; -- Gitee