From: Lijo Lazar Date: Tue, 5 Aug 2025 12:10:09 +0000 (+0530) Subject: drm/amdgpu/vcn: Fix double-free of vcn dump buffer X-Git-Tag: v6.18-rc1~134^2~19^2~133 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1a0e57eb96c3fca338665ffd7d9b59f351e5fea7;p=thirdparty%2Fkernel%2Flinux.git drm/amdgpu/vcn: Fix double-free of vcn dump buffer The buffer is already freed as part of amdgpu_vcn_reg_dump_fini(). The issue is introduced by below patch series. Fixes: de55cbff5ce9 ("drm/amdgpu/vcn: Add regdump helper functions") Signed-off-by: Lijo Lazar Reviewed-by: Sathishkumar S Signed-off-by: Alex Deucher --- diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c index b497a67141384..050a5411aae54 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c @@ -1549,6 +1549,7 @@ int amdgpu_vcn_reg_dump_init(struct amdgpu_device *adev, static void amdgpu_vcn_reg_dump_fini(struct amdgpu_device *adev) { kfree(adev->vcn.ip_dump); + adev->vcn.ip_dump = NULL; adev->vcn.reg_list = NULL; adev->vcn.reg_count = 0; } diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c index ff2a85619f232..95173156f956a 100644 --- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c +++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c @@ -354,7 +354,6 @@ static int vcn_v3_0_sw_fini(struct amdgpu_ip_block *ip_block) return r; } - kfree(adev->vcn.ip_dump); return 0; } diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c index c6450ed65c12d..019bd362edb22 100644 --- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c +++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c @@ -280,8 +280,6 @@ static int vcn_v4_0_3_sw_fini(struct amdgpu_ip_block *ip_block) return r; } - kfree(adev->vcn.ip_dump); - return 0; } diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c index f785467370d9a..75c884a8f556b 100644 --- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c +++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c @@ -275,8 +275,6 @@ static int vcn_v4_0_5_sw_fini(struct amdgpu_ip_block *ip_block) return r; } - kfree(adev->vcn.ip_dump); - return 0; }