[PATCH 0/2] platform/x86: ISST: Two ioctl input validation fixes

[PATCH 0/2] platform/x86: ISST: Two ioctl input validation fixes

[HyeongJun An]

Two out-of-bounds accesses reachable from the ISST character device
ioctls, both from user-supplied index values that are not bounded before
use.

The first is an off-by-one on socket_id in the CLOS association ioctl,
plus a missing NULL check on the resulting instance pointer. The same
file already gets both of these right in get_instance(), which rejects
pkg_id with in_range(pkg_id, 0, topology_max_packages()) and then checks
the instance for NULL before returning it.

The second is a missing level bound in the two perf-mask ioctls. The
four adjacent helpers that read the same per-level register block all
reject a level above max_level first.

Neither path is behind CAP_SYS_ADMIN. Commit 69cd1ca440a9 ("platform/x86:
ISST: Check for admin capability for write commands") describes
deployments that relax the permissions on /dev/isst_interface so that
non-root users can read SST capabilities, and deliberately gates only the
write commands.

Found by inspection, not reproduced on hardware.

HyeongJun An (2):
  platform/x86: ISST: Validate socket ID in clos_assoc ioctl
  platform/x86: ISST: Validate level in perf mask ioctls

 .../x86/intel/speed_select_if/isst_tpmi_core.c      | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

-- 
2.43.0

[PATCH 1/2] platform/x86: ISST: Validate socket ID in clos_assoc ioctl

[HyeongJun An]

isst_if_clos_assoc() validates the user-supplied socket_id with
'socket_id > topology_max_packages()', but isst_common.sst_inst[] is
allocated with topology_max_packages() entries, so the valid index range
is [0, topology_max_packages()).  The '>' comparison lets
socket_id == topology_max_packages() pass and index one entry past the
array.

In addition, isst_common.sst_inst[socket_id] is NULL for an in-range
package that has no bound TPMI SST instance, and the pointer is used
without a NULL check.  Both the out-of-bounds entry and the NULL pointer
are then dereferenced by map_partition_power_domain_id() and the
following power_domain_info access.

Reject socket_id >= topology_max_packages() and a NULL sst_inst, matching
the checks already performed by get_instance().

Fixes: 12a7d2cb811d ("platform/x86: ISST: Add SST-CP support via TPMI")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
---
 drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
index 24334ae70d82..b2965baeaa36 100644
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -729,7 +729,7 @@ static long isst_if_clos_assoc(void __user *argp)
 		if (copy_from_user(&clos_assoc, ptr, sizeof(clos_assoc)))
 			return -EFAULT;
 
-		if (clos_assoc.socket_id > topology_max_packages())
+		if (clos_assoc.socket_id >= topology_max_packages())
 			return -EINVAL;
 
 		cpu = clos_assoc.logical_cpu;
@@ -747,6 +747,8 @@ static long isst_if_clos_assoc(void __user *argp)
 		pkg_id = clos_assoc.socket_id;
 
 		sst_inst = isst_common.sst_inst[pkg_id];
+		if (!sst_inst)
+			return -EINVAL;
 
 		punit_id = map_partition_power_domain_id(sst_inst, punit_id, &part);
 		if (punit_id < 0)
-- 
2.43.0

Re: [PATCH 1/2] platform/x86: ISST: Validate socket ID in clos_assoc ioctl

[srinivas pandruvada]

On Fri, 2026-08-07 at 23:40 +0900, HyeongJun An wrote:
> isst_if_clos_assoc() validates the user-supplied socket_id with
> 'socket_id > topology_max_packages()', but isst_common.sst_inst[] is
> allocated with topology_max_packages() entries, so the valid index
> range
> is [0, topology_max_packages()).  The '>' comparison lets
> socket_id == topology_max_packages() pass and index one entry past
> the
> array.
> 
> In addition, isst_common.sst_inst[socket_id] is NULL for an in-range
> package that has no bound TPMI SST instance, and the pointer is used
> without a NULL check.  Both the out-of-bounds entry and the NULL
> pointer
> are then dereferenced by map_partition_power_domain_id() and the
> following power_domain_info access.
> 
> Reject socket_id >= topology_max_packages() and a NULL sst_inst,
> matching
> the checks already performed by get_instance().
> 
> Fixes: 12a7d2cb811d ("platform/x86: ISST: Add SST-CP support via
> TPMI")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: HyeongJun An <sammiee5311@gmail.com>

Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>

> ---
>  drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git
> a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> index 24334ae70d82..b2965baeaa36 100644
> --- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> +++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> @@ -729,7 +729,7 @@ static long isst_if_clos_assoc(void __user *argp)
>  		if (copy_from_user(&clos_assoc, ptr,
> sizeof(clos_assoc)))
>  			return -EFAULT;
>  
> -		if (clos_assoc.socket_id > topology_max_packages())
> +		if (clos_assoc.socket_id >= topology_max_packages())
>  			return -EINVAL;
>  
>  		cpu = clos_assoc.logical_cpu;
> @@ -747,6 +747,8 @@ static long isst_if_clos_assoc(void __user *argp)
>  		pkg_id = clos_assoc.socket_id;
>  
>  		sst_inst = isst_common.sst_inst[pkg_id];
> +		if (!sst_inst)
> +			return -EINVAL;
>  
>  		punit_id = map_partition_power_domain_id(sst_inst,
> punit_id, &part);
>  		if (punit_id < 0)

[PATCH 2/2] platform/x86: ISST: Validate level in perf mask ioctls

[HyeongJun An]

isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the
user-provided level as an index into perf_levels[] via
_read_pp_level_info() and _read_bf_level_info(), but neither helper
validates it first.

The adjacent level-info helpers reject levels above max_level before
reading the same per-level register block. Add the same bounds checks to
the mask helpers, and reject disabled SST-PP levels in
isst_if_get_perf_level_mask() to match isst_if_get_perf_level_info().

This prevents out-of-bounds reads from the per-level offset table on
invalid ioctl input.

Fixes: ea009e4769fa3 ("platform/x86: ISST: Add SST-PP support via TPMI")
Fixes: 06a61df83209 ("platform/x86: ISST: Add SST-BF support via TPMI")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
---
 .../platform/x86/intel/speed_select_if/isst_tpmi_core.c  | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
index b2965baeaa36..f1b6109521c5 100644
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -1263,6 +1263,12 @@ static int isst_if_get_perf_level_mask(void __user *argp)
 	if (!power_domain_info)
 		return -EINVAL;
 
+	if (cpumask.level > power_domain_info->max_level)
+		return -EINVAL;
+
+	if (!(power_domain_info->pp_header.level_en_mask & BIT(cpumask.level)))
+		return -EINVAL;
+
 	_read_pp_level_info("mask", mask, cpumask.level, SST_PP_INFO_2_OFFSET,
 			    SST_PP_RSLVD_CORE_MASK_START, SST_PP_RSLVD_CORE_MASK_WIDTH,
 			    SST_MUL_FACTOR_NONE)
@@ -1344,6 +1350,9 @@ static int isst_if_get_base_freq_mask(void __user *argp)
 	if (!power_domain_info)
 		return -EINVAL;
 
+	if (cpumask.level > power_domain_info->max_level)
+		return -EINVAL;
+
 	_read_bf_level_info("BF-cpumask", mask, cpumask.level, SST_BF_INFO_1_OFFSET,
 			    P1_HI_CORE_MASK_START, P1_HI_CORE_MASK_WIDTH,
 			    SST_MUL_FACTOR_NONE)
-- 
2.43.0

Re: [PATCH 2/2] platform/x86: ISST: Validate level in perf mask ioctls

[srinivas pandruvada]

On Fri, 2026-08-07 at 23:40 +0900, HyeongJun An wrote:
> isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use
> the
> user-provided level as an index into perf_levels[] via
> _read_pp_level_info() and _read_bf_level_info(), but neither helper
> validates it first.
> 
> The adjacent level-info helpers reject levels above max_level before
> reading the same per-level register block. Add the same bounds checks
> to
> the mask helpers, and reject disabled SST-PP levels in
> isst_if_get_perf_level_mask() to match isst_if_get_perf_level_info().
> 
> This prevents out-of-bounds reads from the per-level offset table on
> invalid ioctl input.
> 
> Fixes: ea009e4769fa3 ("platform/x86: ISST: Add SST-PP support via
> TPMI")
> Fixes: 06a61df83209 ("platform/x86: ISST: Add SST-BF support via
> TPMI")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: HyeongJun An <sammiee5311@gmail.com>

Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>

> ---
>  .../platform/x86/intel/speed_select_if/isst_tpmi_core.c  | 9
> +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git
> a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> index b2965baeaa36..f1b6109521c5 100644
> --- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> +++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> @@ -1263,6 +1263,12 @@ static int isst_if_get_perf_level_mask(void
> __user *argp)
>  	if (!power_domain_info)
>  		return -EINVAL;
>  
> +	if (cpumask.level > power_domain_info->max_level)
> +		return -EINVAL;
> +
> +	if (!(power_domain_info->pp_header.level_en_mask &
> BIT(cpumask.level)))
> +		return -EINVAL;
> +
>  	_read_pp_level_info("mask", mask, cpumask.level,
> SST_PP_INFO_2_OFFSET,
>  			    SST_PP_RSLVD_CORE_MASK_START,
> SST_PP_RSLVD_CORE_MASK_WIDTH,
>  			    SST_MUL_FACTOR_NONE)
> @@ -1344,6 +1350,9 @@ static int isst_if_get_base_freq_mask(void
> __user *argp)
>  	if (!power_domain_info)
>  		return -EINVAL;
>  
> +	if (cpumask.level > power_domain_info->max_level)
> +		return -EINVAL;
> +
>  	_read_bf_level_info("BF-cpumask", mask, cpumask.level,
> SST_BF_INFO_1_OFFSET,
>  			    P1_HI_CORE_MASK_START,
> P1_HI_CORE_MASK_WIDTH,
>  			    SST_MUL_FACTOR_NONE)

Re: [PATCH 0/2] platform/x86: ISST: Two ioctl input validation fixes

[srinivas pandruvada]

On Fri, 2026-08-07 at 23:40 +0900, HyeongJun An wrote:
> Two out-of-bounds accesses reachable from the ISST character device
> ioctls, both from user-supplied index values that are not bounded
> before
> use.
> 
> The first is an off-by-one on socket_id in the CLOS association
> ioctl,
> plus a missing NULL check on the resulting instance pointer. The same
> file already gets both of these right in get_instance(), which
> rejects
> pkg_id with in_range(pkg_id, 0, topology_max_packages()) and then
> checks
> the instance for NULL before returning it.
> 
> The second is a missing level bound in the two perf-mask ioctls. The
> four adjacent helpers that read the same per-level register block all
> reject a level above max_level first.
> 
> Neither path is behind CAP_SYS_ADMIN. Commit 69cd1ca440a9
> ("platform/x86:
> ISST: Check for admin capability for write commands") describes
> deployments that relax the permissions on /dev/isst_interface so that
> non-root users can read SST capabilities, and deliberately gates only
> the
> write commands.
> 
> Found by inspection, not reproduced on hardware.

Thanks for the fixes.

-Srinivas

> 
> HyeongJun An (2):
>   platform/x86: ISST: Validate socket ID in clos_assoc ioctl
>   platform/x86: ISST: Validate level in perf mask ioctls
> 
>  .../x86/intel/speed_select_if/isst_tpmi_core.c      | 13
> ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)