From patchwork Thu Dec 14 15:24:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhipeng Lu X-Patchwork-Id: 178787 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:3b04:b0:fb:cd0c:d3e with SMTP id c4csp8647410dys; Thu, 14 Dec 2023 07:59:49 -0800 (PST) X-Google-Smtp-Source: AGHT+IEuF1Q0RpqtwT6H2ns0XX84VVvlybbFE8O9E+UdD/eW5cAaX14gM/3WQdAikFG0rN6PBuz4 X-Received: by 2002:a05:6a00:2e19:b0:6d0:8c48:9365 with SMTP id fc25-20020a056a002e1900b006d08c489365mr4569810pfb.37.1702569588965; Thu, 14 Dec 2023 07:59:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702569588; cv=none; d=google.com; s=arc-20160816; b=W0W94QZbXSMfvfquuAs5sDtGnHzrSqR9C23kGmg3aJNzcBPGXZu4xPCvlkG6BAM+Za OETmhXrxpTROzDkqiLElWIjG7nAXxdF8CtwI/GJ82vTd0byvKPP0rwixjPjNEh2uxkS4 MI0bac1x2Cz95rgoOUxYr+/3Oz3pGO6PoLVxlxkXVbkt/ztSK2OeBKnafs3ULsxdBaXK QKBBmvMW57/jAbgwN4zLLIQ4RSN3tU66xtTLPlf+b5re+IQHZaDrD1CN2ubKIuyCl8B1 Wl/267VZuGHYMkdseiTZlTqJjGBjh8gLq5P1qHQUgPNbhSSnfgHM/jKJh6l4FWAPDs1Z +zJA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=GuTqX1R4dGMvvVMz1awqP+7gZuV04lWIACPPPcVlUHI=; fh=c3hm+5w4pek3tBpno1xch9WBNICfJMZyJpln63HYe1M=; b=M/Yw0DDqPSjjWOiwdjCn63jJ8Slm3idRLHbxr0S5BvKB9aR0RZgO3B4xeg6NJq2Ca8 469S9gkALCbh1e4tw1vdZmZLZm3jciiH7K0d7GBGe9TYiV4okYXOFdo9VGYjiVR4jOpS sinmRaPIz8TXO+a9vk+joXsmZkMDqNo14OWS8b5SKY8gApv4g+m5SYiKoU0jf/34t8NT D+WBwzP3gb87Nz5r1cAPXqkJtVLY+WQCiQ2YUr3K4hOU+zYMqYuxCx1fQmjjwPVRNf8F Dc5hHXpqhwTYGtswkL3UJZ+gGwlX1zSFsIMvhF5y9ySAFAMlyNFGclzVnEibN1YoCXn+ QSqg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from snail.vger.email (snail.vger.email. [23.128.96.37]) by mx.google.com with ESMTPS id bt12-20020a056a00438c00b00690c23d353asi11611587pfb.217.2023.12.14.07.59.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Dec 2023 07:59:48 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) client-ip=23.128.96.37; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by snail.vger.email (Postfix) with ESMTP id 78FE180D6E4A; Thu, 14 Dec 2023 07:59:47 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at snail.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1573947AbjLNP7i (ORCPT + 99 others); Thu, 14 Dec 2023 10:59:38 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42526 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1573944AbjLNP7g (ORCPT ); Thu, 14 Dec 2023 10:59:36 -0500 Received: from sgoci-sdnproxy-4.icoremail.net (sgoci-sdnproxy-4.icoremail.net [129.150.39.64]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 56743128 for ; Thu, 14 Dec 2023 07:59:38 -0800 (PST) Received: from luzhipeng.223.5.5.5 (unknown [115.200.224.93]) by mail-app2 (Coremail) with SMTP id by_KCgBnbU1ZJntlOkaTAA--.62179S2; Thu, 14 Dec 2023 23:59:22 +0800 (CST) From: Zhipeng Lu To: alexious@zju.edu.cn Cc: Evan Quan , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= , "Pan, Xinhui" , David Airlie , Daniel Vetter , Guchun Chen , Zhenneng Li , Mario Limonciello , Lijo Lazar , Maruthi Bayyavarapu , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [PATCH] drm/amd/pm: fix a double-free in si_dpm_init Date: Thu, 14 Dec 2023 23:24:11 +0800 Message-Id: <20231214152413.3483199-1-alexious@zju.edu.cn> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-CM-TRANSID: by_KCgBnbU1ZJntlOkaTAA--.62179S2 X-Coremail-Antispam: 1UD129KBjvJXoW7urykCF1UJr43Zr15tr1xuFg_yoW8XFWxpF Z3GF98K3yUJF48t3ZrXF10gr1Duw40kay8GrWjkw13A3W5ZF1v9rZ3A3yqqFW8uFZ7ur42 g34qv34DZr4Ikw7anT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvj14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26w1j6s0DM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gc CE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx0E 2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r4j6F4UMcvjeVCFs4IE7xkEbVWUJV W8JwACjcxG0xvY0x0EwIxGrwACjI8F5VA0II8E6IAqYI8I648v4I1lFIxGxcIEc7CjxVA2 Y2ka0xkIwI1l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4 xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r1q6r43 MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I 0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67AKxVWU JVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuYvjfU5s jjDUUUU X-CM-SenderInfo: qrsrjiarszq6lmxovvfxof0/ X-Spam-Status: No, score=-0.6 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,RCVD_IN_VALIDITY_RPBL, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Thu, 14 Dec 2023 07:59:47 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1785273609094234841 X-GMAIL-MSGID: 1785273609094234841 When the allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, amdgpu_free_extended_power_table is called to free some fields of adev. However, when the control flow returns to si_dpm_sw_init, it goes to label dpm_failed and calls si_dpm_fini, which calls amdgpu_free_extended_power_table again and free those fields again. Thus a double-free is triggered. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Signed-off-by: Zhipeng Lu --- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c index fc8e4ac6c8e7..df4f20293c16 100644 --- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c @@ -7379,10 +7379,9 @@ static int si_dpm_init(struct amdgpu_device *adev) kcalloc(4, sizeof(struct amdgpu_clock_voltage_dependency_entry), GFP_KERNEL); - if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) { - amdgpu_free_extended_power_table(adev); + if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) return -ENOMEM; - } + adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count = 4; adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].clk = 0; adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].v = 0;