kv_parse_power_table() allocates rdev->pm.dpm.ps and then allocates a per-state kv_ps (ps_priv) for each entry. If the kv_ps kzalloc() fails, the current code kfree()s rdev->pm.dpm.ps and returns -ENOMEM without clearing the pointer. The load error-unwind path will later call kv_dpm_fini(), which dereferences rdev->pm.dpm.ps[i].ps_priv and then kfree()s rdev->pm.dpm.ps. With rdev->pm.dpm.ps already freed in kv_parse_power_table(), this turns into a use-after-free followed by a double-free. Call flow: radeon_driver_load_kms |-> radeon_device_init |-> radeon_init |-> kv_dpm_init |-> kv_parse_power_table (fails) radeon_driver_unload_kms |-> radeon_device_fini |-> radeon_fini |-> kv_dpm_fini (deref/free rdev->pm.dpm.ps) Fix this by not freeing rdev->pm.dpm.ps in the kv_ps allocation failure path and letting the common unwind/fini path perform the cleanup. Fixes: 41a524abff26 ("drm/radeon/kms: add dpm support for KB/KV") Signed-off-by: Kery Qi --- drivers/gpu/drm/radeon/kv_dpm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c index 4aa050385284..ee1889ecbd97 100644 --- a/drivers/gpu/drm/radeon/kv_dpm.c +++ b/drivers/gpu/drm/radeon/kv_dpm.c @@ -2472,10 +2472,8 @@ static int kv_parse_power_table(struct radeon_device *rdev) if (!rdev->pm.power_state[i].clock_info) return -EINVAL; ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL); - if (ps == NULL) { - kfree(rdev->pm.dpm.ps); + if (ps == NULL) return -ENOMEM; - } rdev->pm.dpm.ps[i].ps_priv = ps; k = 0; idx = (u8 *)&power_state->v2.clockInfoIndex[0]; -- 2.34.1