linux-kernel - Re: [PATCH] drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b814cdb3-ce83-4db1-b512-c69cc54bda4c@amd.com>
Date: Thu, 29 Jan 2026 15:33:17 +0530
From: "Lazar, Lijo" <lijo.lazar@....com>
To: Christian König <christian.koenig@....com>,
 Zilin Guan <zilin@....edu.cn>, alexander.deucher@....com
Cc: airlied@...il.com, simona@...ll.ch, Hawking.Zhang@....com,
 Prike.Liang@....com, le.ma@....com, amd-gfx@...ts.freedesktop.org,
 dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
 jianhao.xu@....edu.cn
Subject: Re: [PATCH] drm/amdgpu: Use kvfree instead of kfree in
 amdgpu_gmc_get_nps_memranges()



On 29-Jan-26 3:00 PM, Christian König wrote:
> On 1/29/26 10:05, Zilin Guan wrote:
>> amdgpu_discovery_get_nps_info() internally allocates memory for ranges
>> using kvcalloc(), which may use vmalloc() for large allocation. Using
>> kfree() to release vmalloc memory will lead to a memory corruption.
>>
>> Use kvfree() to safely handle both kmalloc and vmalloc allocations.
>>
>> Compile tested only. Issue found using a prototype static analysis tool
>> and code review.
>>
>> Fixes: b194d21b9bcc ("drm/amdgpu: Use NPS ranges from discovery table")
>> Signed-off-by: Zilin Guan <zilin@....edu.cn>
> 
> Good catch!
> 
> But i think we rather need to question why amdgpu_discovery_get_nps_info() is using kvcalloc()? I have strong doubts that we need vmalloc() here.
> 

Yes, vmalloc is enough. That change can be made separately or modified 
along with this.

As for this as a standalone change -
	Reviewed-by: Lijo Lazar <lijo.lazar@....com>

Thanks,
Lijo


> Regards,
> Christian.
> 
>> ---
>>   drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
>> index 7e623f91f2d7..cb0d1ac148e9 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
>> @@ -1382,7 +1382,7 @@ int amdgpu_gmc_get_nps_memranges(struct amdgpu_device *adev,
>>   	if (!*exp_ranges)
>>   		*exp_ranges = range_cnt;
>>   err:
>> -	kfree(ranges);
>> +	kvfree(ranges);
>>   
>>   	return ret;
>>   }
>