mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2025-11-10 19:47:12 +00:00
The amdgpu_free_extended_power_table is called in every error-handling
paths of amdgpu_parse_extended_power_table. However, after the following
call chain of returning:
amdgpu_parse_extended_power_table
|-> kv_dpm_init / si_dpm_init
(the only two caller of amdgpu_parse_extended_power_table)
|-> kv_dpm_sw_init / si_dpm_sw_init
(the only caller of kv_dpm_init / si_dpm_init, accordingly)
|-> kv_dpm_fini / si_dpm_fini
(goto dpm_failed in xx_dpm_sw_init)
|-> amdgpu_free_extended_power_table
As above, the amdgpu_free_extended_power_table is called twice in this
returning chain and thus a double-free is triggered. Similarily, the
last kfree in amdgpu_parse_extended_power_table also cause a double free
with amdgpu_free_extended_power_table in kv_dpm_fini.
Fixes:
|
||
|---|---|---|
| .. | ||
| cik_dpm.h | ||
| kv_dpm.c | ||
| kv_dpm.h | ||
| kv_smc.c | ||
| legacy_dpm.c | ||
| legacy_dpm.h | ||
| Makefile | ||
| ppsmc.h | ||
| r600_dpm.h | ||
| si_dpm.c | ||
| si_dpm.h | ||
| si_smc.c | ||
| sislands_smc.h | ||