| From d6fe87308ef477c2dfdd4aa00b1a988b5ebf138d Mon Sep 17 00:00:00 2001 |
| From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= <me@woland.xyz> |
| Date: Sun, 19 Jul 2020 17:54:53 +0200 |
| Subject: [PATCH] drm/amdgpu: Fix NULL dereference in dpm sysfs handlers |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| commit 38e0c89a19fd13f28d2b4721035160a3e66e270b upstream. |
| |
| NULL dereference occurs when string that is not ended with space or |
| newline is written to some dpm sysfs interface (for example pp_dpm_sclk). |
| This happens because strsep replaces the tmp with NULL if the delimiter |
| is not present in string, which is then dereferenced by tmp[0]. |
| |
| Reproduction example: |
| sudo sh -c 'echo -n 1 > /sys/class/drm/card0/device/pp_dpm_sclk' |
| |
| Signed-off-by: Paweł Gronowski <me@woland.xyz> |
| Signed-off-by: Alex Deucher <alexander.deucher@amd.com> |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c |
| index 059f99534d77..557e8deadc9c 100644 |
| --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c |
| +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c |
| @@ -681,8 +681,7 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev, |
| tmp_str++; |
| while (isspace(*++tmp_str)); |
| |
| - while (tmp_str[0]) { |
| - sub_str = strsep(&tmp_str, delimiter); |
| + while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) { |
| ret = kstrtol(sub_str, 0, ¶meter[parameter_size]); |
| if (ret) |
| return -EINVAL; |
| @@ -867,8 +866,7 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask) |
| memcpy(buf_cpy, buf, bytes); |
| buf_cpy[bytes] = '\0'; |
| tmp = buf_cpy; |
| - while (tmp[0]) { |
| - sub_str = strsep(&tmp, delimiter); |
| + while ((sub_str = strsep(&tmp, delimiter)) != NULL) { |
| if (strlen(sub_str)) { |
| ret = kstrtol(sub_str, 0, &level); |
| if (ret) |
| @@ -1274,8 +1272,7 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev, |
| i++; |
| memcpy(buf_cpy, buf, count-i); |
| tmp_str = buf_cpy; |
| - while (tmp_str[0]) { |
| - sub_str = strsep(&tmp_str, delimiter); |
| + while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) { |
| ret = kstrtol(sub_str, 0, ¶meter[parameter_size]); |
| if (ret) { |
| count = -EINVAL; |
| -- |
| 2.27.0 |
| |