From: Len Brown <lenb@kernel.org>
To: linux-pm@vger.kernel.org
Cc: Andy Shevchenko <andriy.shevchenko@intel.com>,
Len Brown <len.brown@intel.com>
Subject: [PATCH 16/18] x86_energy_perf_policy: Fix use-after-free in err_on_hypervisor()
Date: Mon, 19 Oct 2026 12:43:37 -0400 [thread overview]
Message-ID: <77e30731aaa7d6321dbae7bd58e111d4a73dfd4e.1792428130.git.len.brown@intel.com> (raw)
In-Reply-To: <e160a0ae497702e1c32ab163faa63c0043ea9298.1792428130.git.len.brown@intel.com>
From: Len Brown <len.brown@intel.com>
Avoid testing a pointer into a freed buffer.
Assisted-by: GitHub-Copilot:Claude-Sonnet-4.6
Signed-off-by: Len Brown <len.brown@intel.com>
---
.../x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
index 70d889c3e0dc..f8ab9f4465ce 100644
--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
@@ -782,10 +782,10 @@ void err_on_hypervisor(void)
/* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
- buffer = malloc(4096);
+ buffer = calloc(4096, 1);
if (!buffer) {
fclose(cpuinfo);
- err(-ENOMEM, "buffer malloc fail");
+ err(-ENOMEM, "buffer calloc fail");
}
if (!fread(buffer, 1024, 1, cpuinfo)) {
@@ -814,11 +814,10 @@ void err_on_hypervisor(void)
fclose(cpuinfo);
hypervisor = strstr(buffer, "hypervisor");
-
- free(buffer);
-
if (hypervisor)
err(-1, "not supported on this virtual machine");
+
+ free(buffer);
}
/*
--
2.45.2
next prev parent reply other threads:[~2026-10-19 16:52 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-19 16:43 [PATCH 0/18] x86_energy_perf_policy cleanups Len Brown
2026-10-19 16:43 ` [PATCH 01/18] x86_energy_perf_policy: Create msr_path helper Len Brown
2026-10-19 16:43 ` [PATCH 02/18] x86_energy_perf_policy: Enhance MSR probe Len Brown
2026-10-20 9:44 ` Andy Shevchenko
2026-10-19 16:43 ` [PATCH 03/18] x86_energy_perf_policy: Prevent unlikely buffer overflow Len Brown
2026-10-20 9:46 ` Andy Shevchenko
2026-10-19 16:43 ` [PATCH 04/18] x86_energy_perf_policy: Cleanup: Harden with strtol() Len Brown
2026-10-19 16:43 ` [PATCH 05/18] x86_energy_perf_policy: Cleanup: Use snprintf() for platform-profile Len Brown
2026-10-19 16:43 ` [PATCH 06/18] x86_energy_perf_policy: Fix optarg keyword matching Len Brown
2026-10-19 16:43 ` [PATCH 07/18] x86_energy_perf_policy: Cleanup: Fix potential ratio overflow Len Brown
2026-10-19 16:43 ` [PATCH 08/18] x86_energy_perf_policy: Bound package iteration Len Brown
2026-10-19 16:43 ` [PATCH 09/18] x86_energy_perf_policy: Cleanup: Define HWP window max Len Brown
2026-10-19 16:43 ` [PATCH 10/18] x86_energy_perf_policy: Cleanup: Define BCLK_MHZ Len Brown
2026-10-19 16:43 ` [PATCH 11/18] x86_energy_perf_policy: Cleanup: Check fseek() in VM path Len Brown
2026-10-19 16:43 ` [PATCH 12/18] x86_energy_perf_policy: Document MSRHEADER Len Brown
2026-10-19 16:43 ` [PATCH 13/18] x86_energy_perf_policy: Cleanup: Drop unused signal.h Len Brown
2026-10-19 16:43 ` [PATCH 14/18] x86_energy_perf_policy: Cleanup: Constify profile name arg Len Brown
2026-10-19 16:43 ` [PATCH 15/18] x86_energy_perf_policy: Cleanup: Constify HWP strings Len Brown
2026-10-19 16:43 ` Len Brown [this message]
2026-10-19 16:43 ` [PATCH 17/18] x86_energy_perf_policy: Fix write_sysfs() return type Len Brown
2026-10-19 16:43 ` [PATCH 18/18] MAINTAINERS: Add x86_energy_perf_policy Len Brown
2026-10-19 18:33 ` [PATCH 01/18] x86_energy_perf_policy: Create msr_path helper Andy Shevchenko
2026-10-20 9:35 ` Andy Shevchenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=77e30731aaa7d6321dbae7bd58e111d4a73dfd4e.1792428130.git.len.brown@intel.com \
--to=lenb@kernel.org \
--cc=andriy.shevchenko@intel.com \
--cc=len.brown@intel.com \
--cc=linux-pm@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox