Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:1 as permitted sender) client-ip=2620:137:e000::3:1;
MIME-Version: 1.0
References: <20231214162500.3483936-1-alexious@zju.edu.cn>
In-Reply-To: <20231214162500.3483936-1-alexious@zju.edu.cn>
From:   Alex Deucher <alexdeucher@gmail.com>
Date:   Thu, 14 Dec 2023 12:06:26 -0500
Message-ID: <CADnq5_MYKE+GssKugrLZ-0zj1=JxJayxxp4kviVh6kOPi2abZg@mail.gmail.com>
Subject: Re: [PATCH] drivers/amd/pm: fix a use-after-free in kv_parse_power_table
To:     Zhipeng Lu <alexious@zju.edu.cn>
Cc:     Ran Sun <sunran001@208suo.com>, Jammy Zhou <Jammy.Zhou@amd.com>,
        "Pan, Xinhui" <Xinhui.Pan@amd.com>, linux-kernel@vger.kernel.org,
        amd-gfx@lists.freedesktop.org, Le Ma <le.ma@amd.com>,
        dri-devel@lists.freedesktop.org,
        Alex Deucher <alexander.deucher@amd.com>,
        Evan Quan <evan.quan@amd.com>,
        =?UTF-8?Q?Christian_K=C3=B6nig?= <christian.koenig@amd.com>,
        Hawking Zhang <Hawking.Zhang@amd.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Applied.  Thanks!

On Thu, Dec 14, 2023 at 11:57=E2=80=AFAM Zhipeng Lu <alexious@zju.edu.cn> w=
rote:
>
> When ps allocated by kzalloc equals to NULL, kv_parse_power_table
> frees adev->pm.dpm.ps that allocated before. However, after the control
> flow goes through the following call chains:
>
> kv_parse_power_table
>   |-> kv_dpm_init
>         |-> kv_dpm_sw_init
>               |-> kv_dpm_fini
>
> The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its
> first free in kv_parse_power_table and causes a use-after-free bug.
>
> Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts")
> Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
> ---
>  drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c b/drivers/gpu/drm=
/amd/pm/legacy-dpm/kv_dpm.c
> index 5d28c951a319..5cb4725c773f 100644
> --- a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
> +++ b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
> @@ -2735,10 +2735,8 @@ static int kv_parse_power_table(struct amdgpu_devi=
ce *adev)
>                 non_clock_info =3D (struct _ATOM_PPLIB_NONCLOCK_INFO *)
>                         &non_clock_info_array->nonClockInfo[non_clock_arr=
ay_index];
>                 ps =3D kzalloc(sizeof(struct kv_ps), GFP_KERNEL);
> -               if (ps =3D=3D NULL) {
> -                       kfree(adev->pm.dpm.ps);
> +               if (ps =3D=3D NULL)
>                         return -ENOMEM;
> -               }
>                 adev->pm.dpm.ps[i].ps_priv =3D ps;
>                 k =3D 0;
>                 idx =3D (u8 *)&power_state->v2.clockInfoIndex[0];
> --
> 2.34.1
>