Re: [PATCH 2/2] platform/x86: ISST: Validate level in perf mask ioctls

On Fri, 2026-08-07 at 23:40 +0900, HyeongJun An wrote:
> isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use
> the
> user-provided level as an index into perf_levels[] via
> _read_pp_level_info() and _read_bf_level_info(), but neither helper
> validates it first.
> 
> The adjacent level-info helpers reject levels above max_level before
> reading the same per-level register block. Add the same bounds checks
> to
> the mask helpers, and reject disabled SST-PP levels in
> isst_if_get_perf_level_mask() to match isst_if_get_perf_level_info().
> 
> This prevents out-of-bounds reads from the per-level offset table on
> invalid ioctl input.
> 
> Fixes: ea009e4769fa3 ("platform/x86: ISST: Add SST-PP support via
> TPMI")
> Fixes: 06a61df83209 ("platform/x86: ISST: Add SST-BF support via
> TPMI")
> Cc: [email protected]
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: HyeongJun An <[email protected]>

Acked-by: Srinivas Pandruvada <[email protected]>

> ---
>  .../platform/x86/intel/speed_select_if/isst_tpmi_core.c  | 9
> +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git
> a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> index b2965baeaa36..f1b6109521c5 100644
> --- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> +++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
> @@ -1263,6 +1263,12 @@ static int isst_if_get_perf_level_mask(void
> __user *argp)
>  	if (!power_domain_info)
>  		return -EINVAL;
>  
> +	if (cpumask.level > power_domain_info->max_level)
> +		return -EINVAL;
> +
> +	if (!(power_domain_info->pp_header.level_en_mask &
> BIT(cpumask.level)))
> +		return -EINVAL;
> +
>  	_read_pp_level_info("mask", mask, cpumask.level,
> SST_PP_INFO_2_OFFSET,
>  			    SST_PP_RSLVD_CORE_MASK_START,
> SST_PP_RSLVD_CORE_MASK_WIDTH,
>  			    SST_MUL_FACTOR_NONE)
> @@ -1344,6 +1350,9 @@ static int isst_if_get_base_freq_mask(void
> __user *argp)
>  	if (!power_domain_info)
>  		return -EINVAL;
>  
> +	if (cpumask.level > power_domain_info->max_level)
> +		return -EINVAL;
> +
>  	_read_bf_level_info("BF-cpumask", mask, cpumask.level,
> SST_BF_INFO_1_OFFSET,
>  			    P1_HI_CORE_MASK_START,
> P1_HI_CORE_MASK_WIDTH,
>  			    SST_MUL_FACTOR_NONE)