If the requested pstate id is not present in the state list (or the
list is empty, e.g. broken/missing perf tables), the list_for_each_entry
cursor runs off the end of the list and the subsequent
pstate->pstate != req check dereferences the list head cast to a
struct nvkm_pstate, which is an out-of-bounds read.
Track whether the entry was actually found instead of inspecting the
cursor after the loop.
Fixes: 7c8565220697 ("drm/nouveau/clk: implement power state and engine clock
control in core")
Signed-off-by: Francesco Magazzu <[email protected]>
---
Note: essentially the same fix was posted by Dan Carpenter in 2022 and
never picked up; the bug is still present in drm-misc-next. Credit for
spotting it goes to him.
Link: https://lore.kernel.org/dri-devel/YvSkKAdk8Pe0g2K9@kili/
drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
index 572e63846..42f3709e0 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
@@ -479,13 +479,17 @@ nvkm_clk_ustate_update(struct nvkm_clk *clk, int req)
return -ENOSYS;
if (req != -1 && req != -2) {
+ bool found = false;
+
list_for_each_entry(pstate, &clk->states, head) {
- if (pstate->pstate == req)
+ if (pstate->pstate == req) {
+ found = true;
break;
+ }
i++;
}
- if (pstate->pstate != req)
+ if (!found)
return -EINVAL;
req = i;
}
--
2.55.0
