Skip to content

Commit 38e0c89

Browse files
vvolandalexdeucher
authored andcommitted
drm/amdgpu: Fix NULL dereference in dpm sysfs handlers
NULL dereference occurs when string that is not ended with space or newline is written to some dpm sysfs interface (for example pp_dpm_sclk). This happens because strsep replaces the tmp with NULL if the delimiter is not present in string, which is then dereferenced by tmp[0]. Reproduction example: sudo sh -c 'echo -n 1 > /sys/class/drm/card0/device/pp_dpm_sclk' Signed-off-by: Paweł Gronowski <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Cc: [email protected]
1 parent 88bb16a commit 38e0c89

File tree

1 file changed

+3
-6
lines changed

1 file changed

+3
-6
lines changed

drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -778,8 +778,7 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
778778
tmp_str++;
779779
while (isspace(*++tmp_str));
780780

781-
while (tmp_str[0]) {
782-
sub_str = strsep(&tmp_str, delimiter);
781+
while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
783782
ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
784783
if (ret)
785784
return -EINVAL;
@@ -1039,8 +1038,7 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
10391038
memcpy(buf_cpy, buf, bytes);
10401039
buf_cpy[bytes] = '\0';
10411040
tmp = buf_cpy;
1042-
while (tmp[0]) {
1043-
sub_str = strsep(&tmp, delimiter);
1041+
while ((sub_str = strsep(&tmp, delimiter)) != NULL) {
10441042
if (strlen(sub_str)) {
10451043
ret = kstrtol(sub_str, 0, &level);
10461044
if (ret)
@@ -1637,8 +1635,7 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev,
16371635
i++;
16381636
memcpy(buf_cpy, buf, count-i);
16391637
tmp_str = buf_cpy;
1640-
while (tmp_str[0]) {
1641-
sub_str = strsep(&tmp_str, delimiter);
1638+
while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
16421639
ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
16431640
if (ret)
16441641
return -EINVAL;

0 commit comments

Comments
 (0)