From: Henry Martin Date: Mon, 5 Jan 2026 09:57:01 +0000 (-0800) Subject: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() X-Git-Tag: v5.10.248~56 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bd1dcfba72aac4159c1d5e17cd861e702e6c19ac;p=thirdparty%2Fkernel%2Fstable.git cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() [ Upstream commit 484d3f15cc6cbaa52541d6259778e715b2c83c54 ] cpufreq_cpu_get_raw() can return NULL when the target CPU is not present in the policy->cpus mask. scmi_cpufreq_get_rate() does not check for this case, which results in a NULL pointer dereference. Add NULL check after cpufreq_cpu_get_raw() to prevent this issue. Fixes: 99d6bdf33877 ("cpufreq: add support for CPU DVFS based on SCMI message protocol") Signed-off-by: Henry Martin Acked-by: Sudeep Holla Signed-off-by: Viresh Kumar Signed-off-by: Sasha Levin [Shivani: Modified to apply on 5.10.y] Signed-off-by: Shivani Agarwal Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c index bb1389f276d7a..6b65d537c95c2 100644 --- a/drivers/cpufreq/scmi-cpufreq.c +++ b/drivers/cpufreq/scmi-cpufreq.c @@ -29,12 +29,18 @@ static const struct scmi_handle *handle; static unsigned int scmi_cpufreq_get_rate(unsigned int cpu) { - struct cpufreq_policy *policy = cpufreq_cpu_get_raw(cpu); + struct cpufreq_policy *policy; + struct scmi_data *priv; const struct scmi_perf_ops *perf_ops = handle->perf_ops; - struct scmi_data *priv = policy->driver_data; unsigned long rate; int ret; + policy = cpufreq_cpu_get_raw(cpu); + if (unlikely(!policy)) + return 0; + + priv = policy->driver_data; + ret = perf_ops->freq_get(handle, priv->domain_id, &rate, false); if (ret) return 0;