netdev - [PATCH] drm/radeon/sumo: Avoid UAF/double-free on power table parse errors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260108184823.1795-1-qikeyu2017@gmail.com>
Date: Fri,  9 Jan 2026 02:48:23 +0800
From: Kery Qi <qikeyu2017@...il.com>
To: christian.koenig@....com
Cc: netdev@...r.kernel.org,
	Kery Qi <qikeyu2017@...il.com>
Subject: [PATCH] drm/radeon/sumo: Avoid UAF/double-free on power table parse errors

sumo_parse_power_table() allocates rdev->pm.dpm.ps and then allocates a
per-state sumo_ps (ps_priv) for each entry. On error, it currently frees
rdev->pm.dpm.ps in two places:

- if (!rdev->pm.power_state[i].clock_info) { kfree(rdev->pm.dpm.ps); ... }
- if (ps == NULL) { kfree(rdev->pm.dpm.ps); ... }

However, when sumo_parse_power_table() fails during the load/init path,
the driver later unwinds and calls the corresponding fini path, which
dereferences rdev->pm.dpm.ps[i].ps_priv and then frees rdev->pm.dpm.ps.

Freeing rdev->pm.dpm.ps inside sumo_parse_power_table() leaves a dangling
pointer that the unwind/fini path will both dereference and free again,
resulting in a use-after-free and a double-free.

Fix this by removing the local kfree(rdev->pm.dpm.ps) from the error
returns in sumo_parse_power_table() and letting the common unwind/fini
path perform the cleanup.
Fixes: 80ea2c129c76 ("drm/radeon/kms: add dpm support for sumo asics (v2)")

Signed-off-by: Kery Qi <qikeyu2017@...il.com>
---
 drivers/gpu/drm/radeon/sumo_dpm.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c
index b11f7c5bbcbe..af649b7b2e1a 100644
--- a/drivers/gpu/drm/radeon/sumo_dpm.c
+++ b/drivers/gpu/drm/radeon/sumo_dpm.c
@@ -1491,15 +1491,11 @@ static int sumo_parse_power_table(struct radeon_device *rdev)
 		non_clock_array_index = power_state->v2.nonClockInfoIndex;
 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
-		if (!rdev->pm.power_state[i].clock_info) {
-			kfree(rdev->pm.dpm.ps);
+		if (!rdev->pm.power_state[i].clock_info)
 			return -EINVAL;
-		}
 		ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
-		if (ps == NULL) {
-			kfree(rdev->pm.dpm.ps);
+		if (ps == NULL)
 			return -ENOMEM;
-		}
 		rdev->pm.dpm.ps[i].ps_priv = ps;
 		k = 0;
 		idx = (u8 *)&power_state->v2.clockInfoIndex[0];
-- 
2.34.1