In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix variable 'mcafuncs' dereferenced before NULL check in 'amdgpumcasmugetmcaentry()'
Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpumca.c:377 amdgpumcasmugetmcaentry() warn: variable dereferenced before check 'mca_funcs' (see line 368)
357 int amdgpumcasmugetmcaentry(struct amdgpudevice *adev, enum amdgpumcaerrortype type, 358 int idx, struct mcabankentry *entry) 359 { 360 const struct amdgpumcasmufuncs *mcafuncs = adev->mca.mcafuncs; 361 int count; 362 363 switch (type) { 364 case AMDGPUMCAERRORTYPEUE: 365 count = mcafuncs->maxue_count;
mca_funcs is dereferenced here.
366 break; 367 case AMDGPUMCAERRORTYPECE: 368 count = mcafuncs->maxce_count;
mca_funcs is dereferenced here.
369 break; 370 default: 371 return -EINVAL; 372 } 373 374 if (idx >= count) 375 return -EINVAL; 376 377 if (mcafuncs && mcafuncs->mcagetmca_entry) ^^^^^^^^^
Checked too late!