From bfa486fae2755e607c26c283e21e71e9cf9e863e Mon Sep 17 00:00:00 2001 From: Umio Yasuno Date: Tue, 15 Jul 2025 14:44:35 +0000 Subject: [PATCH] drm/amd/pm: fix null pointer access mainline inclusion from mainline-v6.17-rc1 commit d524d40e3a6152a3ea1125af729f8cd8ca65efde category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWGGL CVE: CVE-2025-38705 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d524d40e3a6152a3ea1125af729f8cd8ca65efde -------------------------------- Writing a string without delimiters (' ', '\n', '\0') to the under gpu_od/fan_ctrl sysfs or pp_power_profile_mode for the CUSTOM profile will result in a null pointer dereference. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4401 Signed-off-by: Umio Yasuno Acked-by: Alex Deucher Signed-off-by: Alex Deucher Signed-off-by: xieguangyao Conflicts: drivers/gpu/drm/amd/pm/amdgpu_pm.c [Keep only the modifications based on the existing code.] --- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c index babb73147adf..27120063e38a 100644 --- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c +++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c @@ -1448,6 +1448,8 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev, if (ret) return -EINVAL; parameter_size++; + if (!tmp_str) + break; while (isspace(*tmp_str)) tmp_str++; } -- Gitee