Commit 38e0c89a authored by Paweł Gronowski's avatar Paweł Gronowski Committed by Alex Deucher

drm/amdgpu: Fix NULL dereference in dpm sysfs handlers

NULL dereference occurs when string that is not ended with space or
newline is written to some dpm sysfs interface (for example pp_dpm_sclk).
This happens because strsep replaces the tmp with NULL if the delimiter
is not present in string, which is then dereferenced by tmp[0].

Reproduction example:
sudo sh -c 'echo -n 1 > /sys/class/drm/card0/device/pp_dpm_sclk'
Signed-off-by: default avatarPaweł Gronowski <me@woland.xyz>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
parent 88bb16ad
...@@ -778,8 +778,7 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev, ...@@ -778,8 +778,7 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
tmp_str++; tmp_str++;
while (isspace(*++tmp_str)); while (isspace(*++tmp_str));
while (tmp_str[0]) { while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
sub_str = strsep(&tmp_str, delimiter);
ret = kstrtol(sub_str, 0, &parameter[parameter_size]); ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
if (ret) if (ret)
return -EINVAL; return -EINVAL;
...@@ -1039,8 +1038,7 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask) ...@@ -1039,8 +1038,7 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
memcpy(buf_cpy, buf, bytes); memcpy(buf_cpy, buf, bytes);
buf_cpy[bytes] = '\0'; buf_cpy[bytes] = '\0';
tmp = buf_cpy; tmp = buf_cpy;
while (tmp[0]) { while ((sub_str = strsep(&tmp, delimiter)) != NULL) {
sub_str = strsep(&tmp, delimiter);
if (strlen(sub_str)) { if (strlen(sub_str)) {
ret = kstrtol(sub_str, 0, &level); ret = kstrtol(sub_str, 0, &level);
if (ret) if (ret)
...@@ -1637,8 +1635,7 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev, ...@@ -1637,8 +1635,7 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev,
i++; i++;
memcpy(buf_cpy, buf, count-i); memcpy(buf_cpy, buf, count-i);
tmp_str = buf_cpy; tmp_str = buf_cpy;
while (tmp_str[0]) { while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
sub_str = strsep(&tmp_str, delimiter);
ret = kstrtol(sub_str, 0, &parameter[parameter_size]); ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
if (ret) if (ret)
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment