Skip to content

Commit 9cb2682

Browse files
vvolandalexdeucher
authored andcommitted
drm/amdgpu: Fix NULL dereference in dpm sysfs handlers
NULL dereference occurs when string that is not ended with space or newline is written to some dpm sysfs interface (for example pp_dpm_sclk). This happens because strsep replaces the tmp with NULL if the delimiter is not present in string, which is then dereferenced by tmp[0]. Reproduction example: sudo sh -c 'echo -n 1 > /sys/class/drm/card0/device/pp_dpm_sclk' Signed-off-by: Paweł Gronowski <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
1 parent 0c56c86 commit 9cb2682

File tree

1 file changed

+3
-6
lines changed

1 file changed

+3
-6
lines changed

drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -796,8 +796,7 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
796796
tmp_str++;
797797
while (isspace(*++tmp_str));
798798

799-
while (tmp_str[0]) {
800-
sub_str = strsep(&tmp_str, delimiter);
799+
while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
801800
ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
802801
if (ret)
803802
return -EINVAL;
@@ -1067,8 +1066,7 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
10671066
memcpy(buf_cpy, buf, bytes);
10681067
buf_cpy[bytes] = '\0';
10691068
tmp = buf_cpy;
1070-
while (tmp[0]) {
1071-
sub_str = strsep(&tmp, delimiter);
1069+
while ((sub_str = strsep(&tmp, delimiter)) != NULL) {
10721070
if (strlen(sub_str)) {
10731071
ret = kstrtol(sub_str, 0, &level);
10741072
if (ret)
@@ -1697,8 +1695,7 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev,
16971695
i++;
16981696
memcpy(buf_cpy, buf, count-i);
16991697
tmp_str = buf_cpy;
1700-
while (tmp_str[0]) {
1701-
sub_str = strsep(&tmp_str, delimiter);
1698+
while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
17021699
ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
17031700
if (ret)
17041701
return -EINVAL;

0 commit comments

Comments
 (0)