In the Linux kernel, the following vulnerability has been resolved:
drm/amd/pm: fix double free in siparsepower_table()
In function siparsepowertable(), array adev->pm.dpm.ps and its member is allocated. If the allocation of each member fails, the array itself is freed and returned with an error code. However, the array is later freed again in sidpm_fini() function which is called when the function returns an error.
This leads to potential double free of the array adev->pm.dpm.ps, as well as leak of its array members, since the members are not freed in the allocation function and the array is not nulled when freed. In addition adev->pm.dpm.numps, which keeps track of the allocated array member, is not updated until the member allocation is successfully finished, this could also lead to either use after free, or uninitialized variable access in sidpm_fini().
Fix this by postponing the free of the array until sidpmfini() and increment adev->pm.dpm.num_ps everytime the array member is allocated.
[
{
"digest": {
"length": 2484.0,
"function_hash": "331824897495393372156764054196221070620"
},
"target": {
"function": "si_parse_power_table",
"file": "drivers/gpu/drm/amd/pm/powerplay/si_dpm.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd2eff8b9dcbe469c3b7bbbc7083ab5ed94de07b",
"deprecated": false,
"id": "CVE-2022-49530-62f74b60",
"signature_type": "Function"
},
{
"digest": {
"length": 2484.0,
"function_hash": "331824897495393372156764054196221070620"
},
"target": {
"function": "si_parse_power_table",
"file": "drivers/gpu/drm/amd/amdgpu/si_dpm.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0e811c4ccf3b42705976285e3a94cc82dea7300",
"deprecated": false,
"id": "CVE-2022-49530-67da072f",
"signature_type": "Function"
},
{
"digest": {
"length": 2484.0,
"function_hash": "331824897495393372156764054196221070620"
},
"target": {
"function": "si_parse_power_table",
"file": "drivers/gpu/drm/amd/amdgpu/si_dpm.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af832028af6f44c6c45645757079c4ed6884ade5",
"deprecated": false,
"id": "CVE-2022-49530-72f5903a",
"signature_type": "Function"
},
{
"digest": {
"length": 2484.0,
"function_hash": "331824897495393372156764054196221070620"
},
"target": {
"function": "si_parse_power_table",
"file": "drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3fa2becf2fc25b6ac7cf8d8b1a2e4a86b3b72bd",
"deprecated": false,
"id": "CVE-2022-49530-78ffd440",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"175928000842382159687881398093421011326",
"286579101182698501959612177359067612266",
"215126785542643646315314159128705096770",
"179576666621132720895963510861806256765",
"193176049198101824567002608768519924690",
"123925448435481578579888811633569613405",
"81122235514969649992011102999578935336",
"101424513744246705301597504290818452041",
"271061021124979461764211103948651817097",
"14055986498837665027027607417538265451",
"4518844406556724580719940570630924962",
"255399333938970866779294629458578496299",
"307451379556419634091172719934941347815",
"16502835968557624766098283103945242473",
"13332781669622762184655734691330354627",
"192951544092935551410844489707147722376",
"311383009686200251981497620835315692995",
"264452113299727212678194750141950094013",
"115389418533569617599809110182614852301",
"274458141034828769497556462639814825745"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/amd/amdgpu/si_dpm.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0e811c4ccf3b42705976285e3a94cc82dea7300",
"deprecated": false,
"id": "CVE-2022-49530-80353b32",
"signature_type": "Line"
},
{
"digest": {
"length": 2468.0,
"function_hash": "264694970861114473441270064353242773301"
},
"target": {
"function": "si_parse_power_table",
"file": "drivers/gpu/drm/amd/amdgpu/si_dpm.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2615464854505188f909d0c07c37a6623693b5c7",
"deprecated": false,
"id": "CVE-2022-49530-8c515018",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"175928000842382159687881398093421011326",
"286579101182698501959612177359067612266",
"215126785542643646315314159128705096770",
"179576666621132720895963510861806256765",
"193176049198101824567002608768519924690",
"123925448435481578579888811633569613405",
"81122235514969649992011102999578935336",
"101424513744246705301597504290818452041",
"271061021124979461764211103948651817097",
"14055986498837665027027607417538265451",
"4518844406556724580719940570630924962",
"255399333938970866779294629458578496299",
"307451379556419634091172719934941347815",
"16502835968557624766098283103945242473",
"13332781669622762184655734691330354627",
"192951544092935551410844489707147722376",
"311383009686200251981497620835315692995",
"264452113299727212678194750141950094013",
"115389418533569617599809110182614852301",
"274458141034828769497556462639814825745"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/amd/pm/powerplay/si_dpm.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd2eff8b9dcbe469c3b7bbbc7083ab5ed94de07b",
"deprecated": false,
"id": "CVE-2022-49530-d7f47e27",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"175928000842382159687881398093421011326",
"286579101182698501959612177359067612266",
"215126785542643646315314159128705096770",
"179576666621132720895963510861806256765",
"193176049198101824567002608768519924690",
"123925448435481578579888811633569613405",
"81122235514969649992011102999578935336",
"101424513744246705301597504290818452041",
"271061021124979461764211103948651817097",
"14055986498837665027027607417538265451",
"4518844406556724580719940570630924962",
"255399333938970866779294629458578496299",
"307451379556419634091172719934941347815",
"16502835968557624766098283103945242473",
"13332781669622762184655734691330354627",
"192951544092935551410844489707147722376",
"311383009686200251981497620835315692995",
"264452113299727212678194750141950094013",
"115389418533569617599809110182614852301",
"274458141034828769497556462639814825745"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/amd/amdgpu/si_dpm.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af832028af6f44c6c45645757079c4ed6884ade5",
"deprecated": false,
"id": "CVE-2022-49530-dd199488",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"175928000842382159687881398093421011326",
"286579101182698501959612177359067612266",
"215126785542643646315314159128705096770",
"179576666621132720895963510861806256765",
"193176049198101824567002608768519924690",
"123925448435481578579888811633569613405",
"81122235514969649992011102999578935336",
"101424513744246705301597504290818452041",
"271061021124979461764211103948651817097",
"14055986498837665027027607417538265451",
"4518844406556724580719940570630924962",
"255399333938970866779294629458578496299",
"307451379556419634091172719934941347815",
"16502835968557624766098283103945242473",
"13332781669622762184655734691330354627",
"192951544092935551410844489707147722376",
"311383009686200251981497620835315692995",
"264452113299727212678194750141950094013",
"115389418533569617599809110182614852301",
"274458141034828769497556462639814825745"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3fa2becf2fc25b6ac7cf8d8b1a2e4a86b3b72bd",
"deprecated": false,
"id": "CVE-2022-49530-fd562a0a",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"175928000842382159687881398093421011326",
"286579101182698501959612177359067612266",
"215126785542643646315314159128705096770",
"179576666621132720895963510861806256765",
"193176049198101824567002608768519924690",
"123925448435481578579888811633569613405",
"81122235514969649992011102999578935336",
"101424513744246705301597504290818452041",
"271061021124979461764211103948651817097",
"14055986498837665027027607417538265451",
"4518844406556724580719940570630924962",
"255399333938970866779294629458578496299",
"307451379556419634091172719934941347815",
"16502835968557624766098283103945242473",
"13332781669622762184655734691330354627",
"192951544092935551410844489707147722376",
"311383009686200251981497620835315692995",
"25451210506747129107367712122903513010",
"108329502308897732107650168791400268644",
"86653951993671676438504700239539281553"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/amd/amdgpu/si_dpm.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2615464854505188f909d0c07c37a6623693b5c7",
"deprecated": false,
"id": "CVE-2022-49530-fe946f1c",
"signature_type": "Line"
}
]