[PATCH] drm/radeon/kv: Avoid UAF/double-free on power table parse error

[PATCH] drm/radeon/kv: Avoid UAF/double-free on power table parse error

[Kery Qi]

kv_parse_power_table() allocates rdev->pm.dpm.ps and then allocates a
per-state kv_ps (ps_priv) for each entry. If the kv_ps kzalloc() fails,
the current code kfree()s rdev->pm.dpm.ps and returns -ENOMEM without
clearing the pointer.

The load error-unwind path will later call kv_dpm_fini(), which
dereferences rdev->pm.dpm.ps[i].ps_priv and then kfree()s rdev->pm.dpm.ps.
With rdev->pm.dpm.ps already freed in kv_parse_power_table(), this turns
into a use-after-free followed by a double-free.

Call flow:

radeon_driver_load_kms
|-> radeon_device_init
    |-> radeon_init
        |-> kv_dpm_init
            |-> kv_parse_power_table   (fails)

radeon_driver_unload_kms
|-> radeon_device_fini
    |-> radeon_fini
        |-> kv_dpm_fini                (deref/free rdev->pm.dpm.ps)

Fix this by not freeing rdev->pm.dpm.ps in the kv_ps allocation failure
path and letting the common unwind/fini path perform the cleanup.
Fixes: 41a524abff26 ("drm/radeon/kms: add dpm support for KB/KV")

Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
---
 drivers/gpu/drm/radeon/kv_dpm.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 4aa050385284..ee1889ecbd97 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2472,10 +2472,8 @@ static int kv_parse_power_table(struct radeon_device *rdev)
 		if (!rdev->pm.power_state[i].clock_info)
 			return -EINVAL;
 		ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL);
-		if (ps == NULL) {
-			kfree(rdev->pm.dpm.ps);
+		if (ps == NULL)
 			return -ENOMEM;
-		}
 		rdev->pm.dpm.ps[i].ps_priv = ps;
 		k = 0;
 		idx = (u8 *)&power_state->v2.clockInfoIndex[0];
-- 
2.34.1