lkml.org 
[lkml]   [2020]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 78/86] drm/amdgpu: Fix NULL dereference in dpm sysfs handlers
    Date
    From: Paweł Gronowski <me@woland.xyz>

    commit 38e0c89a19fd13f28d2b4721035160a3e66e270b upstream.

    NULL dereference occurs when string that is not ended with space or
    newline is written to some dpm sysfs interface (for example pp_dpm_sclk).
    This happens because strsep replaces the tmp with NULL if the delimiter
    is not present in string, which is then dereferenced by tmp[0].

    Reproduction example:
    sudo sh -c 'echo -n 1 > /sys/class/drm/card0/device/pp_dpm_sclk'

    Signed-off-by: Paweł Gronowski <me@woland.xyz>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 9 +++------
    1 file changed, 3 insertions(+), 6 deletions(-)

    --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
    +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
    @@ -529,8 +529,7 @@ static ssize_t amdgpu_set_pp_od_clk_volt

    while (isspace(*++tmp_str));

    - while (tmp_str[0]) {
    - sub_str = strsep(&tmp_str, delimiter);
    + while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
    ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
    if (ret)
    return -EINVAL;
    @@ -630,8 +629,7 @@ static ssize_t amdgpu_read_mask(const ch
    memcpy(buf_cpy, buf, bytes);
    buf_cpy[bytes] = '\0';
    tmp = buf_cpy;
    - while (tmp[0]) {
    - sub_str = strsep(&tmp, delimiter);
    + while ((sub_str = strsep(&tmp, delimiter)) != NULL) {
    if (strlen(sub_str)) {
    ret = kstrtol(sub_str, 0, &level);
    if (ret)
    @@ -882,8 +880,7 @@ static ssize_t amdgpu_set_pp_power_profi
    i++;
    memcpy(buf_cpy, buf, count-i);
    tmp_str = buf_cpy;
    - while (tmp_str[0]) {
    - sub_str = strsep(&tmp_str, delimiter);
    + while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
    ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
    if (ret) {
    count = -EINVAL;

    \
     
     \ /
      Last update: 2020-07-27 16:13    [W:4.091 / U:0.480 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site