⬢ DragonFlyBSD Kernel Audit
DF-4951 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/amd/powerplay/hwmgr/vega12_processpptables.c b/sys/dev/drm/amd/powerplay/hwmgr/vega12_processpptables.c
index 10461c4..0565b10 100644
--- a/sys/dev/drm/amd/powerplay/hwmgr/vega12_processpptables.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/vega12_processpptables.c
@@ -298,6 +298,17 @@ static int vega12_pp_tables_uninitialize(struct pp_hwmgr *hwmgr)
 	struct phm_ppt_v3_information *pp_table_info =
 			(struct phm_ppt_v3_information *)(hwmgr->pptable);
 
+	/*
+	 * hwmgr_hw_init() error paths (hwmgr.c err1/err2) already invoke
+	 * pptable_fini() once and leave hwmgr->pptable == NULL, while
+	 * hwmgr->pm_en stays set.  Any later hwmgr_hw_fini() -- a second
+	 * pp_table sysfs write (amd_powerplay_reset), driver teardown or
+	 * GPU reset -- re-enters this function and would dereference
+	 * NULL at the first kfree() (DF-4951).
+	 */
+	if (pp_table_info == NULL)
+		return 0;
+
 	kfree(pp_table_info->power_saving_clock_max);
 	pp_table_info->power_saving_clock_max = NULL;