From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D72C156C72 for ; Wed, 26 Feb 2025 02:15:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536126; cv=none; b=ibBjCNNEvoUV9rzFGGpgsme35cEJxodybNsS88ie2mo07iUh1QWljbwzoLRx1NX6OWgoF1C9svzAy4XqFEKnrQi2mRxnDBWLjGKUfQDjn8eenUFEm2RlPx++N8wmhzW+3lU7yO06A66Vq9/Yjg4HL9NylmKQdhPSrhz2aohNBZQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536126; c=relaxed/simple; bh=nYWGXcsxEMMNNMIU2Yh0vd+i71D5DkvaXwXAYV1xDyU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nDRGoN1JUX3KRj5AtcGzXB0AJjzfr68zvj8+r52DnVi1R1KcG5AsVtbnLIZhBvJjFLJzvL8TPUixbrvrWYpjjXTvYCnhVOlIaEw9pVAjtm2jTaisazNby9mJtGMnSkIN37TPrCeCMM1NvatZeUR8iqUm8KDgnnTKUQq8ZlpNYE4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fwkrprLg; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="fwkrprLg" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E6F9C4CEDD; Wed, 26 Feb 2025 02:15:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536126; bh=nYWGXcsxEMMNNMIU2Yh0vd+i71D5DkvaXwXAYV1xDyU=; h=From:To:Cc:Subject:Date:Reply-to:From; b=fwkrprLgleHWw1sVE7qXy34zd74v6a1yBgpiaxEAYVsJ0glHPD9umcqbincULVgvj o4/sWX2OZJCMZyUu6RgCIB7MqPrORk0P37WPXF7hAKkoFtOWJ6968PvPzb3JHhhBY2 teeEzQT0JTtoWsQN8gr9Z/5+xpWcncchF+jTL0oI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49530: drm/amd/pm: fix double free in si_parse_power_table() Date: Wed, 26 Feb 2025 03:13:24 +0100 Message-ID: <2025022612-CVE-2022-49530-e721@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3559; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=nYWGXcsxEMMNNMIU2Yh0vd+i71D5DkvaXwXAYV1xDyU=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7Klg8uq7dVJnKfuKGyK+kW2dirli4pPKuuZBxodb42 /95reIfOmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAib7oZFkyr2ODp6icxX3f2 sUdFPUlH+O1TXBgW7C88wbr9c9e/RXvXBbNzbLYTE+wyAAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix double free in si_parse_power_table() In function si_parse_power_table(), array adev->pm.dpm.ps and its member is allocated. If the allocation of each member fails, the array itself is freed and returned with an error code. However, the array is later freed again in si_dpm_fini() function which is called when the function returns an error. This leads to potential double free of the array adev->pm.dpm.ps, as well as leak of its array members, since the members are not freed in the allocation function and the array is not nulled when freed. In addition adev->pm.dpm.num_ps, which keeps track of the allocated array member, is not updated until the member allocation is successfully finished, this could also lead to either use after free, or uninitialized variable access in si_dpm_fini(). Fix this by postponing the free of the array until si_dpm_fini() and increment adev->pm.dpm.num_ps everytime the array member is allocated. The Linux kernel CVE team has assigned CVE-2022-49530 to this issue. Affected and fixed versions =========================== Fixed in 4.9.318 with commit 2615464854505188f909d0c07c37a6623693b5c7 Fixed in 4.14.283 with commit 6c5bdaa1325be7f04b79ea992ab216739192d342 Fixed in 4.19.247 with commit c0e811c4ccf3b42705976285e3a94cc82dea7300 Fixed in 5.4.198 with commit af832028af6f44c6c45645757079c4ed6884ade5 Fixed in 5.10.121 with commit ca1ce206894dd976275c78ee38dbc19873f22de9 Fixed in 5.15.46 with commit a5ce7051db044290b1a95045ff03c249005a3aa4 Fixed in 5.17.14 with commit fd2eff8b9dcbe469c3b7bbbc7083ab5ed94de07b Fixed in 5.18.3 with commit 43eb9b667b95f2a31c63e8949b0d2161b9be59c3 Fixed in 5.19 with commit f3fa2becf2fc25b6ac7cf8d8b1a2e4a86b3b72bd Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49530 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/2615464854505188f909d0c07c37a6623693b5c7 https://git.kernel.org/stable/c/6c5bdaa1325be7f04b79ea992ab216739192d342 https://git.kernel.org/stable/c/c0e811c4ccf3b42705976285e3a94cc82dea7300 https://git.kernel.org/stable/c/af832028af6f44c6c45645757079c4ed6884ade5 https://git.kernel.org/stable/c/ca1ce206894dd976275c78ee38dbc19873f22de9 https://git.kernel.org/stable/c/a5ce7051db044290b1a95045ff03c249005a3aa4 https://git.kernel.org/stable/c/fd2eff8b9dcbe469c3b7bbbc7083ab5ed94de07b https://git.kernel.org/stable/c/43eb9b667b95f2a31c63e8949b0d2161b9be59c3 https://git.kernel.org/stable/c/f3fa2becf2fc25b6ac7cf8d8b1a2e4a86b3b72bd