[PATCH] drm/amdgpu: Fix NULL dereference in dpm sysfs handlers

[Alex Deucher]

Applied.  Thanks!

Alex

On Sun, Jul 19, 2020 at 12:22 PM Paweł Gronowski <me at woland.xyz> wrote:
>
> NULL dereference occurs when string that is not ended with space or
> newline is written to some dpm sysfs interface (for example pp_dpm_sclk).
> This happens because strsep replaces the tmp with NULL if the delimiter
> is not present in string, which is then dereferenced by tmp[0].
>
> Reproduction example:
> sudo sh -c 'echo -n 1 > /sys/class/drm/card0/device/pp_dpm_sclk'
>
> Signed-off-by: Paweł Gronowski <me at woland.xyz>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 9 +++------
>  1 file changed, 3 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
> index 02e6f8c4dde0..ebb8a28ff002 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
> @@ -778,8 +778,7 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
>                 tmp_str++;
>         while (isspace(*++tmp_str));
>
> -       while (tmp_str[0]) {
> -               sub_str = strsep(&tmp_str, delimiter);
> +       while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
>                 ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
>                 if (ret)
>                         return -EINVAL;
> @@ -1039,8 +1038,7 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
>         memcpy(buf_cpy, buf, bytes);
>         buf_cpy[bytes] = '\0';
>         tmp = buf_cpy;
> -       while (tmp[0]) {
> -               sub_str = strsep(&tmp, delimiter);
> +       while ((sub_str = strsep(&tmp, delimiter)) != NULL) {
>                 if (strlen(sub_str)) {
>                         ret = kstrtol(sub_str, 0, &level);
>                         if (ret)
> @@ -1637,8 +1635,7 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev,
>                         i++;
>                 memcpy(buf_cpy, buf, count-i);
>                 tmp_str = buf_cpy;
> -               while (tmp_str[0]) {
> -                       sub_str = strsep(&tmp_str, delimiter);
> +               while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
>                         ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
>                         if (ret)
>                                 return -EINVAL;
> --
> 2.25.1
>
> _______________________________________________
> amd-gfx mailing list
> amd-gfx at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/amd-gfx