drm/amd/pm: fix a double-free in amdgpu_parse_extended_power_table
authorZhipeng Lu <alexious@zju.edu.cn>
Thu, 14 Dec 2023 16:59:38 +0000 (00:59 +0800)
committerAlex Deucher <alexander.deucher@amd.com>
Thu, 14 Dec 2023 20:29:08 +0000 (15:29 -0500)
commita6582701178a47c4d0cb2188c965c59c0c0647c8
tree653ce21587976770a0358ca7416f68fc32de2c4d
parentc2709b2d6a537ca0fa0f1da36fdaf07e48ef447d
drm/amd/pm: fix a double-free in amdgpu_parse_extended_power_table

The amdgpu_free_extended_power_table is called in every error-handling
paths of amdgpu_parse_extended_power_table. However, after the following
call chain of returning:

amdgpu_parse_extended_power_table
  |-> kv_dpm_init / si_dpm_init
      (the only two caller of amdgpu_parse_extended_power_table)
        |-> kv_dpm_sw_init / si_dpm_sw_init
            (the only caller of kv_dpm_init / si_dpm_init, accordingly)
              |-> kv_dpm_fini / si_dpm_fini
                  (goto dpm_failed in xx_dpm_sw_init)
                    |-> amdgpu_free_extended_power_table

As above, the amdgpu_free_extended_power_table is called twice in this
returning chain and thus a double-free is triggered. Similarily, the
last kfree in amdgpu_parse_extended_power_table also cause a double free
with amdgpu_free_extended_power_table in kv_dpm_fini.

Fixes: 84176663e70d ("drm/amd/pm: create a new holder for those APIs used only by legacy ASICs(si/kv)")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c