DragonFlyBSD Kernel Audit
DF-1167 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
--- a/sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -713,9 +713,17 @@
 	}
 
 	/* Initialize Vddc DPM table based on allow Vddc values.  And populate corresponding std values. */
+	/* DF-1167: std_voltage_table (cac_leakage_table) may be NULL
+	 * (processpptables.c:1470) and may have fewer entries than the SCLK
+	 * table; the original loop indexed it under sclk_table->count with no
+	 * NULL check and no bound, causing a NULL-deref panic or OOB read. */
 	for (i = 0; i < allowed_vdd_sclk_table->count; i++) {
 		data->dpm_table.vddc_table.dpm_levels[i].value = allowed_vdd_mclk_table->entries[i].v;
-		data->dpm_table.vddc_table.dpm_levels[i].param1 = std_voltage_table->entries[i].Leakage;
+		if (std_voltage_table != NULL && i < std_voltage_table->count)
+			data->dpm_table.vddc_table.dpm_levels[i].param1 =
+				std_voltage_table->entries[i].Leakage;
+		else
+			data->dpm_table.vddc_table.dpm_levels[i].param1 = 0;
 		/* param1 is for corresponding std voltage */
 		data->dpm_table.vddc_table.dpm_levels[i].enabled = 1;
 	}