From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794060566; b=msqlpGjW/G3jbsxoFV2O6DA//ylc0uLr7K5wci4foa11iUtrvMvgD/LVr2vBpVbNJhcl OdC0ZSZ2YNQHdiXiF/ibAYa/wIOfYwzhbeJPXmiuFkRha/aJQZgMi3qtCi1c6DWW7zhP3 s9PRnoE27RFqjYRHz338lQHIUbxzEoJN97ll9nrK+Ppyp5DuMfl884seag4Smhi6CSE3z jmGMbp7enQfwnMmD4sX1nXbiJ5rb248TKKWnK+zE7XsaauBUDIHgNlT6vz7kTTu7omTcJ Rp5O++kN59P3ExvMB8m8hWkNurwmycezXVl1BUP6FyVALqMyvaQGXvHQC9gpoP5+PxA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794060566; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=NBZlaEbhfwr9kPfaPN+d3xUBDlnArd1TOZQ2EwWKZfw=; b=nU8ofTYNPLkLVO1ud4vWTR20ijXzdffSVno2LTS5RY9tbYbLlM4m8MvgTFmLXWDfLfRm v1WFLaUQFDvm3qnKl1qoo2sCft073bvfcUMFwPmF9+mRmW7gMHx367iBOhl2i7lwwSmD1 KgXotrSROpzjI9hO0Iu0wU13vd72Poi41VYKWgUhlAd9pYOLZpNdPkmXeZT3WOm3glCIe M1Q2catisPCN9oxwwCAVQMhxegEGpuYTfA8SyLy0I7aXy/eLeCQYyaHvcCOq+CykBN5J2 dTQfasnO+wxLOstIgN8SnIOMwgl9bvMwjffVqTh5QeK8XTZGnslparlNSdT/LtTdW5Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=CYE2i2+s; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A023B606A330; Sat, 7 Nov 2026 14:09:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=CYE2i2+s Received: by smtp.kernel.org (Postfix) with ESMTPSA id 29C221F0089F; Sat, 7 Nov 2026 14:09:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794060566; bh=NBZlaEbhfwr9kPfaPN+d3xUBDlnArd1TOZQ2EwWKZfw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CYE2i2+sPnptkSzsmJaXVjiFUGb3tql+g4wLgX0VGg7IHfeLbgbQfbkG06irU41fD Urgr8/Oz+IIyoOAoRbDrMyyq6r9W4SNyTCpOi/TCsVjiwBDPcr7eQw+2F5sktnPtHE A2/hKTKxPyZHgsGqjvjpbIGvgpxA8Ucl1Qzmzx2Q= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Ruoyu Wang , Alex Deucher , Sasha Levin Subject: [PATCH 6.12 0028/1536] drm/radeon: avoid double free in r600 DPM cleanup Date: Sat, 7 Nov 2026 08:34:04 -0500 Message-ID: <20261107134958.463929334@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134957.653319350@linuxfoundation.org> References: <20261107134957.653319350@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ruoyu Wang [ Upstream commit d3f30034f861a585f8e487ae1555d9f288a96f87 ] r600_parse_extended_power_table() uses manual kfree() calls for some early allocation failures, but the freed pointers are left in the dynamic power-management state. If device teardown later calls r600_free_extended_power_table(), those stale pointers can be freed again. Use the common extended power table cleanup helper for those early failure paths as well, and clear each pointer after freeing it so repeated cleanup stays safe. Signed-off-by: Ruoyu Wang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin --- drivers/gpu/drm/radeon/r600_dpm.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c index 81d58ef667dd4..2bc0bdfd11590 100644 --- a/drivers/gpu/drm/radeon/r600_dpm.c +++ b/drivers/gpu/drm/radeon/r600_dpm.c @@ -933,7 +933,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev) ret = r600_parse_clk_voltage_dep_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk, dep_table); if (ret) { - kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries); + r600_free_extended_power_table(rdev); return ret; } } @@ -944,8 +944,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev) ret = r600_parse_clk_voltage_dep_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk, dep_table); if (ret) { - kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries); - kfree(rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk.entries); + r600_free_extended_power_table(rdev); return ret; } } @@ -956,9 +955,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev) ret = r600_parse_clk_voltage_dep_table(&rdev->pm.dpm.dyn_state.mvdd_dependency_on_mclk, dep_table); if (ret) { - kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk.entries); - kfree(rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk.entries); - kfree(rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk.entries); + r600_free_extended_power_table(rdev); return ret; } } @@ -1298,17 +1295,29 @@ void r600_free_extended_power_table(struct radeon_device *rdev) struct radeon_dpm_dynamic_state *dyn_state = &rdev->pm.dpm.dyn_state; kfree(dyn_state->vddc_dependency_on_sclk.entries); + dyn_state->vddc_dependency_on_sclk.entries = NULL; kfree(dyn_state->vddci_dependency_on_mclk.entries); + dyn_state->vddci_dependency_on_mclk.entries = NULL; kfree(dyn_state->vddc_dependency_on_mclk.entries); + dyn_state->vddc_dependency_on_mclk.entries = NULL; kfree(dyn_state->mvdd_dependency_on_mclk.entries); + dyn_state->mvdd_dependency_on_mclk.entries = NULL; kfree(dyn_state->cac_leakage_table.entries); + dyn_state->cac_leakage_table.entries = NULL; kfree(dyn_state->phase_shedding_limits_table.entries); + dyn_state->phase_shedding_limits_table.entries = NULL; kfree(dyn_state->ppm_table); + dyn_state->ppm_table = NULL; kfree(dyn_state->cac_tdp_table); + dyn_state->cac_tdp_table = NULL; kfree(dyn_state->vce_clock_voltage_dependency_table.entries); + dyn_state->vce_clock_voltage_dependency_table.entries = NULL; kfree(dyn_state->uvd_clock_voltage_dependency_table.entries); + dyn_state->uvd_clock_voltage_dependency_table.entries = NULL; kfree(dyn_state->samu_clock_voltage_dependency_table.entries); + dyn_state->samu_clock_voltage_dependency_table.entries = NULL; kfree(dyn_state->acp_clock_voltage_dependency_table.entries); + dyn_state->acp_clock_voltage_dependency_table.entries = NULL; } enum radeon_pcie_gen r600_get_pcie_gen_support(struct radeon_device *rdev, -- 2.53.0