Re: [PATCH 1/2] platform/x86: ISST: Validate socket ID in clos_assoc ioctl

On Fri, 2026-08-07 at 23:40 +0900, HyeongJun An wrote:
> isst_if_clos_assoc() validates the user-supplied socket_id with
> 'socket_id > topology_max_packages()', but isst_common.sst_inst[] is
> allocated with topology_max_packages() entries, so the valid index
> range
> is [0, topology_max_packages()).  The '>' comparison lets
> socket_id == topology_max_packages() pass and index one entry past
> the
> array.
> 
> In addition, isst_common.sst_inst[socket_id] is NULL for an in-range
> package that has no bound TPMI SST instance, and the pointer is used
> without a NULL check.  Both the out-of-bounds entry and the NULL
> pointer
> are then dereferenced by map_partition_power_domain_id() and the
> following power_domain_info access.
> 
> Reject socket_id >= topology_max_packages() and a NULL sst_inst,
> matching
> the checks already performed by get_instance().
> 
> Fixes: 12a7d2cb811d ("platform/x86: ISST: Add SST-CP support via
> TPMI")
> Cc: [email protected]
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: HyeongJun An <[email protected]>

Acked-by: Srinivas Pandruvada <[email protected]>

> ---
>  drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git
> a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> index 24334ae70d82..b2965baeaa36 100644
> --- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> +++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> @@ -729,7 +729,7 @@ static long isst_if_clos_assoc(void __user *argp)
>  		if (copy_from_user(&clos_assoc, ptr,
> sizeof(clos_assoc)))
>  			return -EFAULT;
>  
> -		if (clos_assoc.socket_id > topology_max_packages())
> +		if (clos_assoc.socket_id >= topology_max_packages())
>  			return -EINVAL;
>  
>  		cpu = clos_assoc.logical_cpu;
> @@ -747,6 +747,8 @@ static long isst_if_clos_assoc(void __user *argp)
>  		pkg_id = clos_assoc.socket_id;
>  
>  		sst_inst = isst_common.sst_inst[pkg_id];
> +		if (!sst_inst)
> +			return -EINVAL;
>  
>  		punit_id = map_partition_power_domain_id(sst_inst,
> punit_id, &part);
>  		if (punit_id < 0)