Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8b55b06e authored by Zhipeng Lu's avatar Zhipeng Lu Committed by Greg Kroah-Hartman
Browse files

drivers/amd/pm: fix a use-after-free in kv_parse_power_table 



[ Upstream commit 28dd788382c43b330480f57cd34cde0840896743 ]

When ps allocated by kzalloc equals to NULL, kv_parse_power_table
frees adev->pm.dpm.ps that allocated before. However, after the control
flow goes through the following call chains:

kv_parse_power_table
  |-> kv_dpm_init
        |-> kv_dpm_sw_init
	      |-> kv_dpm_fini

The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its
first free in kv_parse_power_table and causes a use-after-free bug.

Fixes: a2e73f56 ("drm/amdgpu: Add support for CIK parts")
Signed-off-by: default avatarZhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 06d95c99

drivers/gpu/drm/amd/amdgpu/kv_dpm.c

+1 −3
Original line number Diff line number Diff line
@@ -2733,10 +2733,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev) 
		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)

			&non_clock_info_array->nonClockInfo[non_clock_array_index];

		ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL);

		if (ps == NULL) {

			kfree(adev->pm.dpm.ps);

		if (ps == NULL)

			return -ENOMEM;

		}

		adev->pm.dpm.ps[i].ps_priv = ps;

		k = 0;

		idx = (u8 *)&power_state->v2.clockInfoIndex[0];