From patchwork Thu Apr 13 15:12:28 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Zhandarovich X-Patchwork-Id: 83021 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp1115162vqo; Thu, 13 Apr 2023 08:19:58 -0700 (PDT) X-Google-Smtp-Source: AKy350YcRtxInIZqk/jyrz1NPowECXNqV41Y0tWWyd+a0LcNTxOEO9f0fgT9oU03oMMbzo/M185M X-Received: by 2002:a05:6808:8ed:b0:389:4c8c:d069 with SMTP id d13-20020a05680808ed00b003894c8cd069mr1247042oic.57.1681399197755; Thu, 13 Apr 2023 08:19:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1681399197; cv=none; d=google.com; s=arc-20160816; b=kSuqXVASskkzwzzjKn0SBLxd2bkfxWrXdvKCCRohN2mQnX0amGyGVNIF8uZkwwjgB/ iZ7wKj3GpSH2qpQaVQjeTvS5IUJBTlzNz8O5KWZ9pSRxQxA3dUwaJiZAphZUPKQWJlFI DGDYGn04gFXykPHWn4+NMxJgtCAZvuZJ3VxeOdBeA0tpo5lVdTDTamlB2tboQv2xjTCn 0GtYLDgP0lKcs2LsHXrtB8ZAJ/6VHw+Osb7mU41QMw2W1cwZpvrnpsFyZxfmibGsBsfv exHq4Egk9APvqbqI6wexZhjGulm0kxpuL95XQQfcH6UzdpOBOpYvy1KVjvvSgwbh7L/E LhpA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=ESd9W+92s784mUO6H+omCeAu7hImXm1Ls8Ceqz8oHs4=; b=EYqu3/p9B6Hcrq7xh3+z5FYW65wePzp5DWvPJQ1fZ+BVOSW0G4RBs9BdDrw+Vote9Z eDs7AOxq+S5+LGsVj8E1vMK8hnadh9wxEJ7dkw4n6R8nKSR3u0CQstjXWmlKXWgBoabF LJuFJa0Yj+SnqNHGuY++vnAzPAary8mXIcvq5l4V5RFyd+rQd2Ibk9MTxpWciL907Ohg SNZgdEH0TleEiHL3uNqmXEF/s7zaviqKMe877uaEm2wPL7HZ0ssTpOY4Ci7C6sqaFqFs pJaNRlh7R+8Vg95GbyoeR/RAnanBflaNdepL8HjCKq3hrNoRp9ZLErA9KVDEqxXDUDnl iUiQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id e14-20020a05680809ae00b003845f28b8a4si1981164oig.162.2023.04.13.08.19.43; Thu, 13 Apr 2023 08:19:57 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230073AbjDMPMk (ORCPT + 99 others); Thu, 13 Apr 2023 11:12:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34080 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229746AbjDMPMi (ORCPT ); Thu, 13 Apr 2023 11:12:38 -0400 Received: from exchange.fintech.ru (e10edge.fintech.ru [195.54.195.159]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A9D3010DF; Thu, 13 Apr 2023 08:12:36 -0700 (PDT) Received: from Ex16-01.fintech.ru (10.0.10.18) by exchange.fintech.ru (195.54.195.159) with Microsoft SMTP Server (TLS) id 14.3.498.0; Thu, 13 Apr 2023 18:12:35 +0300 Received: from localhost (10.0.253.138) by Ex16-01.fintech.ru (10.0.10.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.4; Thu, 13 Apr 2023 18:12:34 +0300 From: Nikita Zhandarovich To: Alex Deucher CC: Nikita Zhandarovich , =?utf-8?q?Christian_K?= =?utf-8?q?=C3=B6nig?= , "Pan, Xinhui" , David Airlie , Daniel Vetter , , , , , , Natalia Petrova Subject: [PATCH v2] radeon: avoid double free in ci_dpm_init() Date: Thu, 13 Apr 2023 08:12:28 -0700 Message-ID: <20230413151228.19714-1-n.zhandarovich@fintech.ru> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.0.253.138] X-ClientProxiedBy: Ex16-02.fintech.ru (10.0.10.19) To Ex16-01.fintech.ru (10.0.10.18) X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1763074845373382606?= X-GMAIL-MSGID: =?utf-8?q?1763074845373382606?= Several calls to ci_dpm_fini() will attempt to free resources that either have been freed before or haven't been allocated yet. This may lead to undefined or dangerous behaviour. For instance, if r600_parse_extended_power_table() fails, it might call r600_free_extended_power_table() as will ci_dpm_fini() later during error handling. Fix this by only freeing pointers to objects previously allocated. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: cc8dbbb4f62a ("drm/radeon: add dpm support for CI dGPUs (v2)") Cc: stable@vger.kernel.org Co-developed-by: Natalia Petrova Signed-off-by: Nikita Zhandarovich --- v2: free only resouces allocated prior, do not remove ci_dpm_fini() or other deallocating calls altogether; fix commit message. v1: https://lore.kernel.org/all/20230403182808.8699-1-n.zhandarovich@fintech.ru/ drivers/gpu/drm/radeon/ci_dpm.c | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c index 8ef25ab305ae..b8f4dac68d85 100644 --- a/drivers/gpu/drm/radeon/ci_dpm.c +++ b/drivers/gpu/drm/radeon/ci_dpm.c @@ -5517,6 +5517,7 @@ static int ci_parse_power_table(struct radeon_device *rdev) u8 frev, crev; u8 *power_state_offset; struct ci_ps *ps; + int ret; if (!atom_parse_data_header(mode_info->atom_context, index, NULL, &frev, &crev, &data_offset)) @@ -5546,11 +5547,15 @@ static int ci_parse_power_table(struct radeon_device *rdev) non_clock_array_index = power_state->v2.nonClockInfoIndex; non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) &non_clock_info_array->nonClockInfo[non_clock_array_index]; - if (!rdev->pm.power_state[i].clock_info) - return -EINVAL; + if (!rdev->pm.power_state[i].clock_info) { + ret = -EINVAL; + goto err_free_ps; + } ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL); - if (ps == NULL) - return -ENOMEM; + if (ps == NULL) { + ret = -ENOMEM; + goto err_free_ps; + } rdev->pm.dpm.ps[i].ps_priv = ps; ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i], non_clock_info, @@ -5590,6 +5595,12 @@ static int ci_parse_power_table(struct radeon_device *rdev) } return 0; + +err_free_ps: + for (i = 0; i < rdev->pm.dpm.num_ps; i++) + kfree(rdev->pm.dpm.ps[i].ps_priv); + kfree(rdev->pm.dpm.ps); + return ret; } static int ci_get_vbios_boot_values(struct radeon_device *rdev, @@ -5678,25 +5689,26 @@ int ci_dpm_init(struct radeon_device *rdev) ret = ci_get_vbios_boot_values(rdev, &pi->vbios_boot_state); if (ret) { - ci_dpm_fini(rdev); + kfree(rdev->pm.dpm.priv); return ret; } ret = r600_get_platform_caps(rdev); if (ret) { - ci_dpm_fini(rdev); + kfree(rdev->pm.dpm.priv); return ret; } ret = r600_parse_extended_power_table(rdev); if (ret) { - ci_dpm_fini(rdev); + kfree(rdev->pm.dpm.priv); return ret; } ret = ci_parse_power_table(rdev); if (ret) { - ci_dpm_fini(rdev); + kfree(rdev->pm.dpm.priv); + r600_free_extended_power_table(rdev); return ret; }