Message-ID: <2025022612-CVE-2022-49530-e721@gregkh>
Date: Wed, 26 Feb 2025 03:13:24 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49530: drm/amd/pm: fix double free in si_parse_power_table()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: fix double free in si_parse_power_table()

In function si_parse_power_table(), array adev->pm.dpm.ps and its member
is allocated. If the allocation of each member fails, the array itself
is freed and returned with an error code. However, the array is later
freed again in si_dpm_fini() function which is called when the function
returns an error.

This leads to potential double free of the array adev->pm.dpm.ps, as
well as leak of its array members, since the members are not freed in
the allocation function and the array is not nulled when freed.
In addition adev->pm.dpm.num_ps, which keeps track of the allocated
array member, is not updated until the member allocation is
successfully finished, this could also lead to either use after free,
or uninitialized variable access in si_dpm_fini().

Fix this by postponing the free of the array until si_dpm_fini() and
increment adev->pm.dpm.num_ps everytime the array member is allocated.

The Linux kernel CVE team has assigned CVE-2022-49530 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.318 with commit 2615464854505188f909d0c07c37a6623693b5c7
	Fixed in 4.14.283 with commit 6c5bdaa1325be7f04b79ea992ab216739192d342
	Fixed in 4.19.247 with commit c0e811c4ccf3b42705976285e3a94cc82dea7300
	Fixed in 5.4.198 with commit af832028af6f44c6c45645757079c4ed6884ade5
	Fixed in 5.10.121 with commit ca1ce206894dd976275c78ee38dbc19873f22de9
	Fixed in 5.15.46 with commit a5ce7051db044290b1a95045ff03c249005a3aa4
	Fixed in 5.17.14 with commit fd2eff8b9dcbe469c3b7bbbc7083ab5ed94de07b
	Fixed in 5.18.3 with commit 43eb9b667b95f2a31c63e8949b0d2161b9be59c3
	Fixed in 5.19 with commit f3fa2becf2fc25b6ac7cf8d8b1a2e4a86b3b72bd

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49530
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2615464854505188f909d0c07c37a6623693b5c7
	https://git.kernel.org/stable/c/6c5bdaa1325be7f04b79ea992ab216739192d342
	https://git.kernel.org/stable/c/c0e811c4ccf3b42705976285e3a94cc82dea7300
	https://git.kernel.org/stable/c/af832028af6f44c6c45645757079c4ed6884ade5
	https://git.kernel.org/stable/c/ca1ce206894dd976275c78ee38dbc19873f22de9
	https://git.kernel.org/stable/c/a5ce7051db044290b1a95045ff03c249005a3aa4
	https://git.kernel.org/stable/c/fd2eff8b9dcbe469c3b7bbbc7083ab5ed94de07b
	https://git.kernel.org/stable/c/43eb9b667b95f2a31c63e8949b0d2161b9be59c3
	https://git.kernel.org/stable/c/f3fa2becf2fc25b6ac7cf8d8b1a2e4a86b3b72bd

Powered by blists - more mailing lists