netdev - [PATCH] drm/radeon/kv: Avoid UAF/double-free on power table parse error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260108181423.1772-2-qikeyu2017@gmail.com>
Date: Fri,  9 Jan 2026 02:14:24 +0800
From: Kery Qi <qikeyu2017@...il.com>
To: alexander.deucher@....com
Cc: netdev@...r.kernel.org,
	Kery Qi <qikeyu2017@...il.com>
Subject: [PATCH] drm/radeon/kv: Avoid UAF/double-free on power table parse error

kv_parse_power_table() allocates rdev->pm.dpm.ps and then allocates a
per-state kv_ps (ps_priv) for each entry. If the kv_ps kzalloc() fails,
the current code kfree()s rdev->pm.dpm.ps and returns -ENOMEM without
clearing the pointer.

The load error-unwind path will later call kv_dpm_fini(), which
dereferences rdev->pm.dpm.ps[i].ps_priv and then kfree()s rdev->pm.dpm.ps.
With rdev->pm.dpm.ps already freed in kv_parse_power_table(), this turns
into a use-after-free followed by a double-free.

Call flow:

radeon_driver_load_kms
|-> radeon_device_init
    |-> radeon_init
        |-> kv_dpm_init
            |-> kv_parse_power_table   (fails)

radeon_driver_unload_kms
|-> radeon_device_fini
    |-> radeon_fini
        |-> kv_dpm_fini                (deref/free rdev->pm.dpm.ps)

Fix this by not freeing rdev->pm.dpm.ps in the kv_ps allocation failure
path and letting the common unwind/fini path perform the cleanup.
Fixes: 41a524abff26 ("drm/radeon/kms: add dpm support for KB/KV")

Signed-off-by: Kery Qi <qikeyu2017@...il.com>
---
 drivers/gpu/drm/radeon/kv_dpm.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 4aa050385284..ee1889ecbd97 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2472,10 +2472,8 @@ static int kv_parse_power_table(struct radeon_device *rdev)
 		if (!rdev->pm.power_state[i].clock_info)
 			return -EINVAL;
 		ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL);
-		if (ps == NULL) {
-			kfree(rdev->pm.dpm.ps);
+		if (ps == NULL)
 			return -ENOMEM;
-		}
 		rdev->pm.dpm.ps[i].ps_priv = ps;
 		k = 0;
 		idx = (u8 *)&power_state->v2.clockInfoIndex[0];
-- 
2.34.1