From: Ali Ahmet Memis <ali@iusegentoo.com>
To: Thomas Renninger <trenn@suse.com>, Shuah Khan <shuah@kernel.org>,
"John B . Wyatt IV" <jwyatt@redhat.com>,
John Kacur <jkacur@redhat.com>
Cc: linux-pm@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH v2 0/2] cpupower: fix topology array handling
Date: Mon, 3 Aug 2026 17:52:06 +0000 [thread overview]
Message-ID: <20260803175215.117518-1-ali@iusegentoo.com> (raw)
v1 did two things in one patch. Shuah asked for them to be split, so here
they are as two.
Patch 1 is the uninitialized read: get_cpu_topology() allocates core_info
with malloc(), several paths never write core_cpu_list, and the sort
comparator then hands that buffer to strcmp(). calloc() fixes it.
Patch 2 is separate and only about the physical core count. The counting
loop seeds cores at 1 from entry 0 without checking whether that entry has
usable topology data, so an incomplete entry can be counted as a core.
Patch 2 depends on patch 1, since it uses an empty core_cpu_list to
recognise an entry that was never filled in.
Tested against a fake sysfs tree with the configured CPU count pinned to 2,
where cpu0 has complete topology and cpu1's topology attributes are absent.
Same harness, one commit apart:
unpatched cores=2 valgrind: errors
patch 1 cores=2 valgrind: clean
patch 1+2 cores=1 valgrind: clean
Unpatched, valgrind traces it to the allocation:
Conditional jump or move depends on uninitialised value(s)
at strcmp (vg_replace_strmem.c:941)
by __compare_core_cpu_list (cpupower.c:159)
by qsort_r (qsort.c:409)
by get_cpu_topology (cpupower.c:214)
Uninitialised value was created by a heap allocation
at malloc (vg_replace_malloc.c:446)
by get_cpu_topology (cpupower.c:174)
I have no machine where a topology attribute actually disappears during
enumeration, so the fake tree is as close as I could get. If you would
rather see this exercised some other way, say so and I will do that.
Link to the v1 review:
https://lore.kernel.org/all/c746110c-6ac4-4500-a4f0-491a06838173@kernel.org/
Ali Ahmet Memis (2):
cpupower: zero the topology array to avoid uninitialized reads
cpupower: do not count incomplete topology entries as physical cores
tools/power/cpupower/lib/cpupower.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--
2.55.0
next reply other threads:[~2026-08-03 17:52 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-03 17:52 Ali Ahmet Memis [this message]
2026-08-03 17:52 ` [PATCH v2 1/2] cpupower: zero the topology array to avoid uninitialized reads Ali Ahmet Memis
2026-08-03 17:52 ` [PATCH v2 2/2] cpupower: do not count incomplete topology entries as physical cores Ali Ahmet Memis
2026-08-04 20:45 ` [PATCH v2 0/2] cpupower: fix topology array handling Shuah Khan
2026-08-05 11:43 ` Ali Ahmet Memis
2026-08-05 12:10 ` Ali Ahmet Memis
2026-08-06 15:50 ` Shuah Khan
2026-08-06 17:51 ` [PATCH v3 0/3] " Ali Ahmet Memis
2026-08-06 17:51 ` [PATCH v3 1/3] cpupower: zero the topology array to avoid uninitialized reads Ali Ahmet Memis
2026-08-06 17:51 ` [PATCH v3 2/3] cpupower: let the core == -1 check handle failed topology reads Ali Ahmet Memis
2026-08-06 17:51 ` [PATCH v3 3/3] cpupower: do not count incomplete topology entries as physical cores Ali Ahmet Memis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260803175215.117518-1-ali@iusegentoo.com \
--to=ali@iusegentoo.com \
--cc=jkacur@redhat.com \
--cc=jwyatt@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=shuah@kernel.org \
--cc=trenn@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.