DF-4951 — vega12_processpptables: double pptable_fini NULL deref

File: sys/dev/drm/amd/powerplay/hwmgr/vega12_processpptables.c Class: CWE-476 (NULL pointer dereference) — kernel panic, root/hw-failure precondition Severity: Low · Bucket: base:drm

What

vega12_pp_tables_uninitialize() (vega12_processpptables.c:296-320) caches pp_table_info = hwmgr->pptable and immediately dereferences it (kfree(pp_table_info->power_saving_clock_max), :301) with no NULL guard. The caller contract makes hwmgr->pptable == NULL a reachable state: hwmgr_hw_init()'s error paths err1:/err2: (hwmgr.c:257-262) already invoke pptable_fini() once — freeing the pptable and NULLing hwmgr->pptable — before returning an error, while hwmgr->pm_en stays TRUE (it is only cleared when pptable funcs are missing, hwmgr.c:216-219) and pm.dpm_enabled retains its stale boot-time TRUE (nothing clears it on the error path).

Any subsequent hwmgr_hw_fini() then re-enters the function and faults at NULL+offset. Reachable triggers after one failed powerplay re-init:

• a second root write to /sys/class/drm/card0/device/pp_table (amdgpu_pm.c:463 → amd_powerplay.c:676 pp_dpm_set_pp_table, gated only on hwmgr && hwmgr->pm_en → amd_powerplay_reset → hwmgr_hw_fini);
• driver teardown / GPU reset paths that reach pptable_fini (the pp IP block's status.hw was set at boot and is not cleared by amd_powerplay_reset).

The failing re-init itself is any hwmgr_hw_init failure at err1/err2 (backend_init / psm_init_power_state_table / phm_setup_asic / enable_dsm failure — e.g. SMU task timeout after a pp_table swap, the classic sleep/wake or table-upload hiccup).

Reproduce (lifted-copy harness; in-kernel path needs a Vega12 ASIC)

./build.sh   # cc -O2 -Wall -o vega12_dfini_null vega12_dfini_null.c
./run.sh     # ./vega12_dfini_null

Expected (run.log): - CASE 1 BOOT-OK (healthy boot + healthy reset): clean exit. - CASE 2 BUG (write#1 → pptable_init OK, backend FAILS → err1 fini inside init; write#2 → fini again): SIGSEGV fault address 0x10 (power_saving_clock_max at phm_ppt_v3_information+16 — kernel-x86-64 offset) = the kernel panic-equivalent. - CASE 3 CONTROL (write#1 fails at the header check → err: path leaks the fresh kzalloc but does NOT fini; write#2 frees it): survives — proving the crash specifically requires the err1/err2 (fini-inside-init) failure and demonstrating the secondary kmem-leak defect on the err: path.

Patched build: cc -O2 -Wall -DPATCHED ... → CASE 2/4 survive (fix_run.log).

Fix validation

• git apply --check fix.diff OK (host tree and guest /usr/src).
• Full amdgpu.ko module rebuild with the fix under the real kernel toolchain, -Werror, -j8: RC=0 in 24 s, vega12_processpptables.o recompiled at fix_build.log:346-347, 0 diagnostics (fix_build.log).
• Guest /usr/src restored and md5-verified afterwards.

Artifacts

vega12_dfini_null.c · build.sh · run.sh · build (in run.log header) · run.log · run.stability.log · fix_run.log · fix.diff · fix_build.log · env.txt · VERDICT.md · manifest.json · verdict.json

VERDICT — DF-4951

Reproduced: YES (lifted-copy harness on the audit guest; in-kernel path hardware-gated — no Vega12 ASIC)

Root cause (proven, path:line)

• vega12_processpptables.c:296-301 — vega12_pp_tables_uninitialize() takes pp_table_info = hwmgr->pptable and dereferences it at the very first statement (kfree(pp_table_info->power_saving_clock_max)) with no NULL guard.
• hwmgr.c:222-231 + 257-262 — hwmgr_hw_init() calls pptable_init (:222) then backend_init (:229); on backend/power-state/ asic/DSM failure it jumps to err1:/err2: which already call pptable_fini() before returning the error. After such a failure hwmgr->pptable == NULL.
• hwmgr.c:216-219 — pm_en is not cleared on these error paths (only when pptable/hwmgr funcs are missing); amdgpu_pm.c / amd_powerplay.c never clear pm.dpm_enabled on the error path either.
• amd_powerplay.c:676-707 — pp_dpm_set_pp_table (sysfs pp_table write, root-only) gates only on hwmgr && hwmgr->pm_en (:680-681) and calls amd_powerplay_reset (:697) → hwmgr_hw_fini (:665) → pptable_fini (hwmgr.c:280-281) → NULL deref at phm_ppt_v3_information+16 (hwmgr.h:579-594 layout, x86-64).
• The pp IP block's status.hw (amdgpu_device.c:1572) was set at boot and is not cleared by amd_powerplay_reset, so driver teardown after a failed reset re-enters the same path.

Harness result (run.log)

• CASE 1 BOOT-OK: healthy init + healthy pp_table reset → clean.
• CASE 2 BUG: boot OK → root pp_table write#1 whose re-init fails at backend_init (err1 → fini inside init, hwmgr->pptable = NULL) → root pp_table write#2 (or teardown) → hwmgr_hw_fini → vega12_pp_tables_uninitialize → SIGSEGV at fault address 0x10 (power_saving_clock_max = pptable+16) — the exact kernel-equivalent fault (kfree(NULL->power_saving_clock_max)).
• CASE 3 CONTROL: write#1 failing at the header check takes the err: path (hwmgr.c:223-224) which does NOT fini — write#2 then frees the leaked (non-NULL) pptable cleanly. This isolates the crash to the err1/err2 failure mode and simultaneously evidences the secondary defect: hwmgr->pptable (kzalloc'd at vega12:272) leaks on every pptable_init failure (the err: path never finis); a root loop of pp_table writes with a header-invalid table grows kmem unboundedly (~small alloc per iteration). Not separately verified as a finding — noted here and folded conceptually into the fix discussion.
• PATCHED (fix.diff NULL guard, -DPATCHED): CASE 2/4 survive, no fault (fix_run.log).

Impact

Kernel NULL-deref panic (CWE-476), fixed fault offset (+16 read then kfree of garbage-free NULL — no data control). Precondition: one failed powerplay re-init (SMU/backend hiccup after a pp_table upload or during runtime re-init) plus a second root-triggered fini (pp_table write, rmmod/teardown, GPU reset). Root-or-failing-hardware gated → Low, consistent with the DF-4546 convention for pre-conditioned panics. No unprivileged path: the sysfs node is 0644 root-writable, and the failing re-init itself requires either root's table or an SMU failure.

Fix validation

• git apply --check OK on the read-only host tree and on guest /usr/src.
• Full amdgpu.ko rebuild with fix.diff applied, real kernel toolchain, -Werror, -j8: RC=0, 0 diagnostics, 24 s (fix_build.log; vega12_processpptables.o at :346-347).
• Harness PATCHED control: the previously-fatal CASE 2 sequence survives.
• Guest /usr/src restored (git apply -R), md5-verified against the pristine tree (085571ce1e8f9c2fafdd71e4e3b2cc95), module objdir cleaned.

Recommended fix

fix.diff: early-return NULL guard in vega12_pp_tables_uninitialize (11 added lines, no behavior change for the healthy path). Longer term, hwmgr.c's err: path should also fini (or init's early returns should free) to close the leak — out of this file's scope, noted for the maintainer.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.