Patch "drivers/amd/pm: fix a use-after-free in kv_parse_power_table" has been added to the 5.4-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    drivers/amd/pm: fix a use-after-free in kv_parse_power_table

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 312e5e74c5a6130079d8976150a7d582db4f98ce
Author: Zhipeng Lu <alexious@xxxxxxxxxx>
Date:   Fri Dec 15 00:24:58 2023 +0800

    drivers/amd/pm: fix a use-after-free in kv_parse_power_table
    
    [ Upstream commit 28dd788382c43b330480f57cd34cde0840896743 ]
    
    When ps allocated by kzalloc equals to NULL, kv_parse_power_table
    frees adev->pm.dpm.ps that allocated before. However, after the control
    flow goes through the following call chains:
    
    kv_parse_power_table
      |-> kv_dpm_init
            |-> kv_dpm_sw_init
                  |-> kv_dpm_fini
    
    The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its
    first free in kv_parse_power_table and causes a use-after-free bug.
    
    Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts")
    Signed-off-by: Zhipeng Lu <alexious@xxxxxxxxxx>
    Signed-off-by: Alex Deucher <alexander.deucher@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
index c8a5a5698edd..6eb6f05c1136 100644
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
@@ -2733,10 +2733,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev)
 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
 		ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL);
-		if (ps == NULL) {
-			kfree(adev->pm.dpm.ps);
+		if (ps == NULL)
 			return -ENOMEM;
-		}
 		adev->pm.dpm.ps[i].ps_priv = ps;
 		k = 0;
 		idx = (u8 *)&power_state->v2.clockInfoIndex[0];




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux