korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-19 17:14:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

drm/radeon: Avoid power table parsing memory leaks

Browse Source 
Avoid leaving a hanging pre-allocated clock_info if last mode is
invalid, and avoid heap corruption if no valid modes are found.

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=211537
Fixes: 6991b8f2a3 ("drm/radeon/kms: fix segfault in pm rework")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Kees Cook 2021-05-02 22:06:08 -07:00 committed by Alex Deucher
parent 3596152510
commit 642f3ad00f
1 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/gpu/drm/radeon/radeon_atombios.c
View File

@ -2120,11 +2120,14 @@ static int radeon_atombios_parse_power_table_1_3(struct radeon_device *rdev)
return state_index;
/* last mode is usually default, array is low to high */
for (i = 0; i < num_modes; i++) {
rdev->pm.power_state[state_index].clock_info =
kcalloc(1, sizeof(struct radeon_pm_clock_info),
GFP_KERNEL);
/* avoid memory leaks from invalid modes or unknown frev. */
if (!rdev->pm.power_state[state_index].clock_info) {
rdev->pm.power_state[state_index].clock_info =
kzalloc(sizeof(struct radeon_pm_clock_info),
GFP_KERNEL);
}
if (!rdev->pm.power_state[state_index].clock_info)
return state_index;
goto out;
rdev->pm.power_state[state_index].num_clock_modes = 1;
rdev->pm.power_state[state_index].clock_info[0].voltage.type = VOLTAGE_NONE;
switch (frev) {
@ -2243,8 +2246,15 @@ static int radeon_atombios_parse_power_table_1_3(struct radeon_device *rdev)
break;
}
}
out:
/* free any unused clock_info allocation. */
if (state_index && state_index < num_modes) {
kfree(rdev->pm.power_state[state_index].clock_info);
rdev->pm.power_state[state_index].clock_info = NULL;
}
/* last mode is usually default */
if (rdev->pm.default_power_state_index == -1) {
if (state_index && rdev->pm.default_power_state_index == -1) {
rdev->pm.power_state[state_index - 1].type =
POWER_STATE_TYPE_DEFAULT;
rdev->pm.default_power_state_index = state_index - 1;