1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-22 16:06:04 -05:00
linux/drivers/acpi
Chris Bainbridge 14578923e8 ACPI: video: Fix random crashes due to bad kfree()
Commit c6a837088b ("drm/amd/display: Fetch the EDID from _DDC if
available for eDP") added function dm_helpers_probe_acpi_edid(), which
fetches the EDID from the BIOS by calling acpi_video_get_edid().

acpi_video_get_edid() returns a pointer to the EDID, but this pointer
does not originate from kmalloc() - it is actually the internal
"pointer" field from an acpi_buffer struct (which did come from
kmalloc()).

dm_helpers_probe_acpi_edid() then attempts to kfree() the EDID pointer,
resulting in memory corruption which leads to random, intermittent
crashes (e.g. 4% of boots will fail with some Oops).

Fix this by allocating a new array (which can be safely freed) for the
EDID data, and correctly freeing the acpi_buffer pointer.

The only other caller of acpi_video_get_edid() is nouveau_acpi_edid():
remove the extraneous kmemdup() here as the EDID data is now copied in
acpi_video_device_EDID().

Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
Fixes: c6a837088b ("drm/amd/display: Fetch the EDID from _DDC if available for eDP")
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Reported-by: Borislav Petkov (AMD) <bp@alien8.de>
Tested-by: Borislav Petkov (AMD) <bp@alien8.de>
Closes: https://lore.kernel.org/amd-gfx/20250110175252.GBZ4FedNKqmBRaY4T3@fat_crate.local/T/#m324a23eb4c4c32fa7e89e31f8ba96c781e496fb1
Link: https://patch.msgid.link/Z4K_oQL7eA9Owkbs@debian.local
[ rjw: Changed function description comment into a kerneldoc one ]
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-01-13 21:09:10 +01:00
..
acpica
apei
arm64
dptf
nfit
numa
pmic
riscv
x86
ac.c
acpi_adxl.c
acpi_apd.c
acpi_configfs.c
acpi_dbg.c
acpi_extlog.c
acpi_ffh.c
acpi_fpdt.c
acpi_ipmi.c
acpi_lpat.c
acpi_lpit.c
acpi_memhotplug.c
acpi_pad.c
acpi_pcc.c
acpi_platform.c
acpi_pnp.c
acpi_processor.c
acpi_tad.c
acpi_video.c ACPI: video: Fix random crashes due to bad kfree() 2025-01-13 21:09:10 +01:00
acpi_watchdog.c
battery.c
bgrt.c
bus.c
button.c
container.c
cppc_acpi.c
debugfs.c
device_pm.c
device_sysfs.c
dock.c
ec.c
ec_sys.c
event.c
evged.c
fan.h
fan_attr.c
fan_core.c
fan_hwmon.c
glue.c
hed.c
internal.h
ioapic.c
irq.c
Kconfig
Makefile
mipi-disco-img.c
nhlt.c
nvs.c
osi.c
osl.c
pci_irq.c
pci_link.c
pci_mcfg.c
pci_root.c
pci_slot.c
pfr_telemetry.c
pfr_update.c
platform_profile.c
power.c
pptt.c
prmt.c
proc.c
processor_core.c
processor_driver.c
processor_idle.c
processor_pdc.c
processor_perflib.c
processor_thermal.c
processor_throttling.c
property.c
reboot.c
resource.c ACPI: resource: acpi_dev_irq_override(): Check DMI match last 2025-01-07 19:26:48 +01:00
sbs.c
sbshc.c
sbshc.h
scan.c
sleep.c
sleep.h
spcr.c
sysfs.c
tables.c
thermal.c
thermal_lib.c
tiny-power-button.c
utils.c
video_detect.c
viot.c
wakeup.c