drm/amd/pm: fix pptable use-after-free

Browse source

amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table
after dropping adev->pm.mutex. The sysfs path then copies from that pointer.
A concurrent pp_table write can replace and free the allocation during the
copy, causing a use-after-free.

Change the DPM interface to copy into caller-provided storage while the mutex
is held. Keep the size-only query for attribute discovery without exposing
the driver-owned pointer.

Fixes: 1684d3ba48 ("drm/amd/amdgpu: change pptable output format from ASCII to binary")
Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

...

This commit is contained in:

Yang Wang 2026-07-24 07:41:29 +08:00 • committed by Alex Deucher

parent 47a71f452c

commit f6eed7acfd

3 changed files with 16 additions and 14 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

14

drivers/gpu/drm/amd/pm/amdgpu_dpm.c

View file

13

drivers/gpu/drm/amd/pm/amdgpu_pm.c

View file

3

drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h

View file