From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793829322; b=VllriBYohfTLe9R2iSt0PQWPbypdWPNH1khp0z7z4IYeCbU6ucrBCc24XS+SO/8E1rR7 sfaneKohTJcS7ojeHqnm2WLO7bmKSpiDdaBJHrQo4CrA8baDFwaUr1qHCgEvVHnO98Y9u 7TX7Rw8YSTcFevxfwtEa7d9GZ1NvJ06vJD7RL+FMgUpKrLHq15Zq+Kc10KX+WHY4lf6xn KDmPytqc2a0xFmCK3aYOrTZJKcyjfZO5CSzpWq0yBWVqaWaJWv4LqqDPFCtsfXXLMTF7v RASrJVrxSdAUKNy2QIQwfFAdgUciFBHTQjzrHZaPQ2igtRS8nkXuCAB2rmC/Z/rWFng== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793829322; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=hO7MS3uuMnW5c461/jiBI0/58V6KGj4tXHN1hnzwTp4=; b=E6Lpe1FCbquXmicgqZiSQ1bSm2H9GaHhLrRTKWZwPyNDja7sYjLcghxnyd5+IuOjC6Wf L9O3CsoKdnAft4Znn8ADCz5xRW8tFL/mLVQNYdwX1Oo2/1WEohufrS/XVosSk3QBu6ZsJ Px5oYnfcpGBYsGNXBPeKHBkWdMEkDSzRql+4dkj9l7hb0qVYmCb0Y64CjXujb65ArRVik XsaQ5jFXnlNR6A+uqHNBSPoFq06f1Q2xi37ZYGNCie5oNoo3fwRUg2RXbK9O3MaBMILbE utFWFrTojgLYHMIXpPqAxK4kAgGNL2FhJxhL9Z3ESHLV1GEMwmSSEkf1oXH8Ih19f4w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Z4xLaEGa; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDCC36074917; Wed, 4 Nov 2026 21:55:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Z4xLaEGa Received: by smtp.kernel.org (Postfix) with ESMTPSA id 906E21F000C1; Wed, 4 Nov 2026 21:55:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793829321; bh=hO7MS3uuMnW5c461/jiBI0/58V6KGj4tXHN1hnzwTp4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Z4xLaEGaqn0oblwFZOjfo0PCiOLmPYJrlfcJjEs4mh2ifCMhew/IiDL/ZG4BDbP6F OE/6PYfrpVgB1oDSiANybtptd8Q0vuR4S2/0TfgAAGdTeQNeeMX8qGxXCYaIuf1VRM p4S2cPVupmRpnJQpx32+V2okR8/hM0jgJ69MJB20= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Ruoyu Wang , Alex Deucher , Sasha Levin Subject: [PATCH 6.18 0022/1005] drm/radeon: avoid double free in r600 DPM cleanup Date: Wed, 4 Nov 2026 15:55:55 -0500 Message-ID: <20261104211044.176885998@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261104211043.516122098@linuxfoundation.org> References: <20261104211043.516122098@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ruoyu Wang [ Upstream commit d3f30034f861a585f8e487ae1555d9f288a96f87 ] r600_parse_extended_power_table() uses manual kfree() calls for some early allocation failures, but the freed pointers are left in the dynamic power-management state. If device teardown later calls r600_free_extended_power_table(), those stale pointers can be freed again. Use the common extended power table cleanup helper for those early failure paths as well, and clear each pointer after freeing it so repeated cleanup stays safe. Signed-off-by: Ruoyu Wang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin --- drivers/gpu/drm/radeon/r600_dpm.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c index 81d58ef667dd4..2bc0bdfd11590 100644 --- a/drivers/gpu/drm/radeon/r600_dpm.c +++ b/drivers/gpu/drm/radeon/r600_dpm.c @@ -933,7 +933,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev) ret = r600_parse_clk_voltage_dep_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk, dep_table); if (ret) { - kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries); + r600_free_extended_power_table(rdev); return ret; } } @@ -944,8 +944,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev) ret = r600_parse_clk_voltage_dep_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk, dep_table); if (ret) { - kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries); - kfree(rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk.entries); + r600_free_extended_power_table(rdev); return ret; } } @@ -956,9 +955,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev) ret = r600_parse_clk_voltage_dep_table(&rdev->pm.dpm.dyn_state.mvdd_dependency_on_mclk, dep_table); if (ret) { - kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries); - kfree(rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk.entries); - kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk.entries); + r600_free_extended_power_table(rdev); return ret; } } @@ -1298,17 +1295,29 @@ void r600_free_extended_power_table(struct radeon_device *rdev) struct radeon_dpm_dynamic_state *dyn_state = &rdev->pm.dpm.dyn_state; kfree(dyn_state->vddc_dependency_on_sclk.entries); + dyn_state->vddc_dependency_on_sclk.entries = NULL; kfree(dyn_state->vddci_dependency_on_mclk.entries); + dyn_state->vddci_dependency_on_mclk.entries = NULL; kfree(dyn_state->vddc_dependency_on_mclk.entries); + dyn_state->vddc_dependency_on_mclk.entries = NULL; kfree(dyn_state->mvdd_dependency_on_mclk.entries); + dyn_state->mvdd_dependency_on_mclk.entries = NULL; kfree(dyn_state->cac_leakage_table.entries); + dyn_state->cac_leakage_table.entries = NULL; kfree(dyn_state->phase_shedding_limits_table.entries); + dyn_state->phase_shedding_limits_table.entries = NULL; kfree(dyn_state->ppm_table); + dyn_state->ppm_table = NULL; kfree(dyn_state->cac_tdp_table); + dyn_state->cac_tdp_table = NULL; kfree(dyn_state->vce_clock_voltage_dependency_table.entries); + dyn_state->vce_clock_voltage_dependency_table.entries = NULL; kfree(dyn_state->uvd_clock_voltage_dependency_table.entries); + dyn_state->uvd_clock_voltage_dependency_table.entries = NULL; kfree(dyn_state->samu_clock_voltage_dependency_table.entries); + dyn_state->samu_clock_voltage_dependency_table.entries = NULL; kfree(dyn_state->acp_clock_voltage_dependency_table.entries); + dyn_state->acp_clock_voltage_dependency_table.entries = NULL; } enum radeon_pcie_gen r600_get_pcie_gen_support(struct radeon_device *rdev, -- 2.53.0