diff options
| author | Zhipeng Lu <alexious@zju.edu.cn> | 2023-12-15 00:59:38 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-01-25 15:27:36 -0800 |
| commit | 2c6537c58bce1a7caeabd43d2380eb2737545521 (patch) | |
| tree | f738fab8e6b69846a1225872807ab6d405a4c64a /include | |
| parent | 4e26e2d485fbbbd313ba30ed59f4db953a192300 (diff) | |
| download | linux-2c6537c58bce1a7caeabd43d2380eb2737545521.tar.gz linux-2c6537c58bce1a7caeabd43d2380eb2737545521.tar.bz2 linux-2c6537c58bce1a7caeabd43d2380eb2737545521.zip | |
drm/amd/pm: fix a double-free in amdgpu_parse_extended_power_table
[ Upstream commit a6582701178a47c4d0cb2188c965c59c0c0647c8 ]
The amdgpu_free_extended_power_table is called in every error-handling
paths of amdgpu_parse_extended_power_table. However, after the following
call chain of returning:
amdgpu_parse_extended_power_table
|-> kv_dpm_init / si_dpm_init
(the only two caller of amdgpu_parse_extended_power_table)
|-> kv_dpm_sw_init / si_dpm_sw_init
(the only caller of kv_dpm_init / si_dpm_init, accordingly)
|-> kv_dpm_fini / si_dpm_fini
(goto dpm_failed in xx_dpm_sw_init)
|-> amdgpu_free_extended_power_table
As above, the amdgpu_free_extended_power_table is called twice in this
returning chain and thus a double-free is triggered. Similarily, the
last kfree in amdgpu_parse_extended_power_table also cause a double free
with amdgpu_free_extended_power_table in kv_dpm_fini.
Fixes: 84176663e70d ("drm/amd/pm: create a new holder for those APIs used only by legacy ASICs(si/kv)")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions