linux-kernel - Re: [PATCH] drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <031ae8a1-5608-4993-91c2-c5945bd6f7ad@amd.com>
Date: Thu, 29 Jan 2026 10:30:28 +0100
From: Christian König <christian.koenig@....com>
To: Zilin Guan <zilin@....edu.cn>, alexander.deucher@....com
Cc: airlied@...il.com, simona@...ll.ch, lijo.lazar@....com,
 Hawking.Zhang@....com, Prike.Liang@....com, le.ma@....com,
 amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
 linux-kernel@...r.kernel.org, jianhao.xu@....edu.cn
Subject: Re: [PATCH] drm/amdgpu: Use kvfree instead of kfree in
 amdgpu_gmc_get_nps_memranges()

On 1/29/26 10:05, Zilin Guan wrote:
> amdgpu_discovery_get_nps_info() internally allocates memory for ranges
> using kvcalloc(), which may use vmalloc() for large allocation. Using
> kfree() to release vmalloc memory will lead to a memory corruption.
> 
> Use kvfree() to safely handle both kmalloc and vmalloc allocations.
> 
> Compile tested only. Issue found using a prototype static analysis tool
> and code review.
> 
> Fixes: b194d21b9bcc ("drm/amdgpu: Use NPS ranges from discovery table")
> Signed-off-by: Zilin Guan <zilin@....edu.cn>

Good catch!

But i think we rather need to question why amdgpu_discovery_get_nps_info() is using kvcalloc()? I have strong doubts that we need vmalloc() here.

Regards,
Christian.

> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
> index 7e623f91f2d7..cb0d1ac148e9 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
> @@ -1382,7 +1382,7 @@ int amdgpu_gmc_get_nps_memranges(struct amdgpu_device *adev,
>  	if (!*exp_ranges)
>  		*exp_ranges = range_cnt;
>  err:
> -	kfree(ranges);
> +	kvfree(ranges);
>  
>  	return ret;
>  }