Messages in this thread Patch in this message | | | From | "Quan, Evan" <> | Subject | RE: [PATCHv2 -next] drm/amdgpu: double free error and freeing uninitialized null pointer | Date | Mon, 1 Aug 2022 01:28:06 +0000 |
| |
[AMD Official Use Only - General]
Reviewed-by: Evan Quan <evan.quan@amd.com>
> -----Original Message----- > From: Sebin Sebastian <mailmesebin00@gmail.com> > Sent: Saturday, July 30, 2022 11:47 AM > Cc: mailmesebin00@gmail.com; Deucher, Alexander > <Alexander.Deucher@amd.com>; Koenig, Christian > <Christian.Koenig@amd.com>; Pan, Xinhui <Xinhui.Pan@amd.com>; David > Airlie <airlied@linux.ie>; Daniel Vetter <daniel@ffwll.ch>; Nirmoy Das > <nirmoy.das@amd.com>; Lazar, Lijo <Lijo.Lazar@amd.com>; Quan, Evan > <Evan.Quan@amd.com>; StDenis, Tom <Tom.StDenis@amd.com>; > Somalapuram, Amaranath <Amaranath.Somalapuram@amd.com>; André > Almeida <andrealmeid@igalia.com>; amd-gfx@lists.freedesktop.org; dri- > devel@lists.freedesktop.org; linux-kernel@vger.kernel.org > Subject: [PATCHv2 -next] drm/amdgpu: double free error and freeing > uninitialized null pointer > > Fix a double free and an uninitialized pointer read error. Both tmp and > new are pointing at same address and both are freed which leads to > double free. Adding a check to verify if new and tmp are free in the > error_free label fixes the double free issue. new is not initialized to > null which also leads to a free on an uninitialized pointer. > > Suggested by: S. Amaranath <Amaranath.Somalapuram@amd.com> > Signed-off-by: Sebin Sebastian <mailmesebin00@gmail.com> > --- > Changes in v2: > Updated patch body as suggested by André Almeida > <andrealmeid@igalia.com> > Reworked to implement a check in error_free for fixing double free error > as suggested by S. Amaranath <Amaranath.Somalapuram@amd.com> > > drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c > index e2eec985adb3..cb00c7d6f50b 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c > @@ -1705,7 +1705,7 @@ static ssize_t > amdgpu_reset_dump_register_list_write(struct file *f, > { > struct amdgpu_device *adev = (struct amdgpu_device > *)file_inode(f)->i_private; > char reg_offset[11]; > - uint32_t *new, *tmp = NULL; > + uint32_t *new = NULL, *tmp = NULL; > int ret, i = 0, len = 0; > > do { > @@ -1747,7 +1747,8 @@ static ssize_t > amdgpu_reset_dump_register_list_write(struct file *f, > ret = size; > > error_free: > - kfree(tmp); > + if (tmp != new) > + kfree(tmp); > kfree(new); > return ret; > } > -- > 2.34.1
| |