mirror of
https://github.com/torvalds/linux.git
synced 2026-06-03 12:03:54 +02:00
The amdgpu_free_extended_power_table is called in every error-handling
paths of amdgpu_parse_extended_power_table. However, after the following
call chain of returning:
amdgpu_parse_extended_power_table
|-> kv_dpm_init / si_dpm_init
(the only two caller of amdgpu_parse_extended_power_table)
|-> kv_dpm_sw_init / si_dpm_sw_init
(the only caller of kv_dpm_init / si_dpm_init, accordingly)
|-> kv_dpm_fini / si_dpm_fini
(goto dpm_failed in xx_dpm_sw_init)
|-> amdgpu_free_extended_power_table
As above, the amdgpu_free_extended_power_table is called twice in this
returning chain and thus a double-free is triggered. Similarily, the
last kfree in amdgpu_parse_extended_power_table also cause a double free
with amdgpu_free_extended_power_table in kv_dpm_fini.
Fixes:
|
||
|---|---|---|
| .. | ||
| inc | ||
| legacy-dpm | ||
| powerplay | ||
| swsmu | ||
| amdgpu_dpm_internal.c | ||
| amdgpu_dpm.c | ||
| amdgpu_pm.c | ||
| Makefile | ||