• Zhipeng Lu's avatar
    drm/amd/pm: fix a double-free in amdgpu_parse_extended_power_table · a6582701
    Zhipeng Lu authored
    The amdgpu_free_extended_power_table is called in every error-handling
    paths of amdgpu_parse_extended_power_table. However, after the following
    call chain of returning:
    
    amdgpu_parse_extended_power_table
      |-> kv_dpm_init / si_dpm_init
          (the only two caller of amdgpu_parse_extended_power_table)
            |-> kv_dpm_sw_init / si_dpm_sw_init
                (the only caller of kv_dpm_init / si_dpm_init, accordingly)
                  |-> kv_dpm_fini / si_dpm_fini
                      (goto dpm_failed in xx_dpm_sw_init)
                        |-> amdgpu_free_extended_power_table
    
    As above, the amdgpu_free_extended_power_table is called twice in this
    returning chain and thus a double-free is triggered. Similarily, the
    last kfree in amdgpu_parse_extended_power_table also cause a double free
    with amdgpu_free_extended_power_table in kv_dpm_fini.
    
    Fixes: 84176663 ("drm/amd/pm: create a new holder for those APIs used only by legacy ASICs(si/kv)")
    Signed-off-by: default avatarZhipeng Lu <alexious@zju.edu.cn>
    Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
    a6582701
legacy_dpm.c 39 KB