![]() [ Upstream commit ac16667237a82e2597e329eb9bc520d1cf9dff30 ]
[tapd]
https://tapd.woa.com/TS4Q/prong/stories/view/1020422414118043047
This fixes CVE-2023-52691
When the allocation of
adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails,
amdgpu_free_extended_power_table is called to free some fields of adev.
However, when the control flow returns to si_dpm_sw_init, it goes to
label dpm_failed and calls si_dpm_fini, which calls
amdgpu_free_extended_power_table again and free those fields again. Thus
a double-free is triggered.
Fixes:
|
||
---|---|---|
.. | ||
drm | ||
host1x | ||
ipu-v3 | ||
vga | ||
Makefile |