[PATCH] cpufreq: apple-soc: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()

[PATCH] cpufreq: apple-soc: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()

[Charles Han]

cpufreq_cpu_get_raw() may return NULL if the cpu is not in
policy->cpus cpu mask and it will cause null pointer dereference.
But this returned value in apple_soc_cpufreq_get_rate() is not
checked. Add NULL check in apple_soc_cpufreq_get_rate(), to handle
kernel NULL pointer dereference error.

Fixes: 6286bbb40576 ("cpufreq: apple-soc: Add new driver to control Apple SoC CPU P-states")
Signed-off-by: Charles Han <hanchunchao@inspur.com>
---
 drivers/cpufreq/apple-soc-cpufreq.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/cpufreq/apple-soc-cpufreq.c b/drivers/cpufreq/apple-soc-cpufreq.c
index 4dcacab9b4bf..1c6d81355b41 100644
--- a/drivers/cpufreq/apple-soc-cpufreq.c
+++ b/drivers/cpufreq/apple-soc-cpufreq.c
@@ -104,6 +104,9 @@ static const struct of_device_id apple_soc_cpufreq_of_match[] __maybe_unused = {
 static unsigned int apple_soc_cpufreq_get_rate(unsigned int cpu)
 {
 	struct cpufreq_policy *policy = cpufreq_cpu_get_raw(cpu);
+	if (unlikely(!policy))
+		return 0;
+
 	struct apple_cpu_priv *priv = policy->driver_data;
 	struct cpufreq_frequency_table *p;
 	unsigned int pstate;
-- 
2.31.1

Re: [PATCH] cpufreq: apple-soc: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()

[Markus Elfring]

> cpufreq_cpu_get_raw() may return NULL if the cpu is not in

                                               CPU?


> policy->cpus cpu mask and it will cause null pointer dereference.
…

Would the summary phrase “Prevent null pointer dereference in apple_soc_cpufreq_get_rate()”
be a bit nicer here?

Regards,
Markus

Re: [PATCH] cpufreq: apple-soc: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()

[Marc Zyngier]

On Mon, 30 Dec 2024 03:57:14 +0000,
Charles Han <hanchunchao@inspur.com> wrote:
> 
> cpufreq_cpu_get_raw() may return NULL if the cpu is not in
> policy->cpus cpu mask and it will cause null pointer dereference.
> But this returned value in apple_soc_cpufreq_get_rate() is not
> checked. Add NULL check in apple_soc_cpufreq_get_rate(), to handle
> kernel NULL pointer dereference error.

The only way I can see a CPU not having an assigned policy is when the
DT is incomplete. And even then, reaching this code path doesn't look
obvious to me.

Can you describe how you get into this situation?

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.