CVE-2025-21780

一、漏洞信息
漏洞编号：CVE-2025-21780
漏洞归属组件：kernel
漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
CVSS V3.0分值：
BaseScore：7.8 High
Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞简述：
In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()It malicious user provides a small pptable through sysfs and thena bigger pptable, it may cause buffer overflow attack in functionsmu_sys_set_pp_table().
漏洞公开时间：2025-02-27 11:15:18
漏洞创建时间：2025-02-27 13:05:37
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2025-21780

更多参考(点击展开)

参考来源	参考链接	来源链接
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1abb2648698bf10783d2236a6b4a7ca5e8021699
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/231075c5a8ea54f34b7c4794687baa980814e6de
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2498d2db1d35e88a2060ea191ae75dce853dd084
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3484ea33157bc7334f57e64826ec5a4bf992151a
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e43a8b9c4d700ffec819c5043a48769b3e7d9cab
suse_bugzilla	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21780	https://bugzilla.suse.com/show_bug.cgi?id=1239115
suse_bugzilla	https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-21780.mbox	https://bugzilla.suse.com/show_bug.cgi?id=1239115
suse_bugzilla	https://git.kernel.org/stable/c/3484ea33157bc7334f57e64826ec5a4bf992151a	https://bugzilla.suse.com/show_bug.cgi?id=1239115
suse_bugzilla	https://git.kernel.org/stable/c/e43a8b9c4d700ffec819c5043a48769b3e7d9cab	https://bugzilla.suse.com/show_bug.cgi?id=1239115
suse_bugzilla	https://git.kernel.org/stable/c/2498d2db1d35e88a2060ea191ae75dce853dd084	https://bugzilla.suse.com/show_bug.cgi?id=1239115
suse_bugzilla	https://git.kernel.org/stable/c/231075c5a8ea54f34b7c4794687baa980814e6de	https://bugzilla.suse.com/show_bug.cgi?id=1239115
suse_bugzilla	https://git.kernel.org/stable/c/1abb2648698bf10783d2236a6b4a7ca5e8021699	https://bugzilla.suse.com/show_bug.cgi?id=1239115
suse_bugzilla	https://www.cve.org/CVERecord?id=CVE-2025-21780	https://bugzilla.suse.com/show_bug.cgi?id=1239115
suse_bugzilla	https://bugzilla.redhat.com/show_bug.cgi?id=2348580	https://bugzilla.suse.com/show_bug.cgi?id=1239115
redhat_bugzilla	https://lore.kernel.org/linux-cve-announce/2025022607-CVE-2025-21780-8283@gregkh/T	https://bugzilla.redhat.com/show_bug.cgi?id=2348580

漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

详情(点击展开)

影响的包	修复版本	修复补丁	来源
linux_kernel	6.1.129	https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3484ea33157bc7334f57e64826ec5a4bf992151aFixed	linuxkernelcves
linux_kernel	6.6.79	https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e43a8b9c4d700ffec819c5043a48769b3e7d9cabFixed	linuxkernelcves
linux_kernel	6.12.16	https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2498d2db1d35e88a2060ea191ae75dce853dd084Fixed	linuxkernelcves
linux_kernel	6.13.4	https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=231075c5a8ea54f34b7c4794687baa980814e6deFixed	linuxkernelcves
linux_kernel	6.14-rc3	https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1abb2648698bf10783d2236a6b4a7ca5e8021699Please	linuxkernelcves

二、漏洞分析结构反馈
影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()It malicious user provides a small pptable through sysfs and thena bigger pptable, it may cause buffer overflow attack in functionsmu_sys_set_pp_table().
openEuler评分：
7.8
Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
受影响版本排查(受影响/不受影响)：
1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-22.03-LTS-SP4(5.10.0):受影响
3.openEuler-24.03-LTS(6.6.0):受影响
4.openEuler-24.03-LTS-SP1(6.6.0):受影响
5.openEuler-24.03-LTS-SP2(6.6.0):受影响
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响
7.master(6.6.0):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.6.0):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
1.openEuler-22.03-LTS-SP3(5.10.0):正常修复
2.openEuler-22.03-LTS-SP4(5.10.0):正常修复
3.openEuler-24.03-LTS(6.6.0):正常修复
4.openEuler-24.03-LTS-SP1(6.6.0):正常修复
5.openEuler-24.03-LTS-SP2(6.6.0):正常修复
6.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
8.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在

Hi openeuler-ci-bot, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers.

@yangyingliang ,@jiaoff ,@guohaocs2c ,@hanjun-guo ,@woqidaideshi ,@newbeats ,@zhangyi089 ,@colyli ,@thundertown ,@htforge ,@chiqijun ,@lengchao ,@zhujianwei001 ,@kylin-mayukun ,@wangxiongfeng ,@wkfxxx ,@SuperSix173 ,@jentlestea ,@oskernel0719 ,@gasonchen 
**issue处理注意事项:** 
**1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;**
**2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;**
**3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否), 原因说明)不能省略,省略后cve-manager将无法正常解析填写内容.**
************************************************************************
影响性分析说明:

openEuler评分: (评分和向量)

受影响版本排查(受影响/不受影响): 
1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):

修复是否涉及abi变化(是/否)：
1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):

原因说明：
1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):

issue处理具体操作请参考: 
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142

参考网址	关联pr	状态	补丁链接
https://nvd.nist.gov/vuln/detail/CVE-2025-21780	None	None	https://git.kernel.org/stable/c/2498d2db1d35e88a2060ea191ae75dce853dd084 https://git.kernel.org/stable/c/1abb2648698bf10783d2236a6b4a7ca5e8021699 https://git.kernel.org/stable/c/231075c5a8ea54f34b7c4794687baa980814e6de https://git.kernel.org/stable/c/3484ea33157bc7334f57e64826ec5a4bf992151a https://git.kernel.org/stable/c/e43a8b9c4d700ffec819c5043a48769b3e7d9cab
https://ubuntu.com/security/CVE-2025-21780	None	None	https://discourse.ubuntu.com/c/project
https://www.opencve.io/cve/CVE-2025-21780	None	None	https://git.kernel.org/stable/c/2498d2db1d35e88a2060ea191ae75dce853dd084 https://git.kernel.org/stable/c/1abb2648698bf10783d2236a6b4a7ca5e8021699 https://git.kernel.org/stable/c/231075c5a8ea54f34b7c4794687baa980814e6de https://git.kernel.org/stable/c/3484ea33157bc7334f57e64826ec5a4bf992151a https://git.kernel.org/stable/c/e43a8b9c4d700ffec819c5043a48769b3e7d9cab
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-21780
https://security-tracker.debian.org/tracker/CVE-2025-21780
http://www.cnnvd.org.cn/web/vulnerability/queryLds.tag?qcvCnnvdid=CVE-2025-21780

说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

CVE-2025-21780

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()

It malicious user provides a small pptable through sysfs and then
a bigger pptable, it may cause buffer overflow attack in function
smu_sys_set_pp_table().

openEuler评分:(评分和向量)
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:受影响
2.openEuler-22.03-LTS-SP3:受影响
3.openEuler-22.03-LTS-SP4:受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS:受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:受影响

原因说明:
1.openEuler-20.03-LTS-SP4:正常修复
2.openEuler-22.03-LTS-SP3:正常修复
3.openEuler-22.03-LTS-SP4:正常修复
4.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS:正常修复
6.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1:正常修复

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP3:否
3.master(23.08.5):否
4.openEuler-24.03-LTS:否
5.openEuler-24.03-LTS-Next:否
6.openEuler-22.03-LTS-SP4:否
7.openEuler-24.03-LTS-SP1:否

===========================================================

@sanglipeng 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 分析项目 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()It malicious user provides a small pptable through sysfs and thena bigger pptable, it may cause buffer overflow attack in functionsmu_sys_set_pp_table().|
|已分析|2.openEulerScore|7.8|
|已分析|3.openEulerVector|AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H|
|已分析|4.受影响版本排查|openEuler-20.03-LTS-SP4:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-22.03-LTS-SP4:受影响,openEuler-24.03-LTS:受影响,openEuler-24.03-LTS-SP1:受影响,master:不受影响,openEuler-24.03-LTS-Next:不受影响|
|已分析|5.是否涉及abi变化|openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP3:否,master:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否,openEuler-24.03-LTS-SP1:否|
|已分析|6.原因说明|openEuler-20.03-LTS-SP4:正常修复,openEuler-22.03-LTS-SP3:正常修复,openEuler-22.03-LTS-SP4:正常修复,openEuler-24.03-LTS:正常修复,openEuler-24.03-LTS-SP1:正常修复,master:不受影响-漏洞代码不能被攻击者触发,openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

CVE-2025-21780

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()

It malicious user provides a small pptable through sysfs and then
a bigger pptable, it may cause buffer overflow attack in function
smu_sys_set_pp_table().

openEuler评分:(评分和向量)
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:受影响
2.openEuler-22.03-LTS-SP3:受影响
3.openEuler-22.03-LTS-SP4:受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS:受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:受影响

原因说明:
1.openEuler-20.03-LTS-SP4:正常修复
2.openEuler-22.03-LTS-SP3:正常修复
3.openEuler-22.03-LTS-SP4:正常修复
4.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS:正常修复
6.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1:正常修复

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP3:否
3.master(23.08.5):否
4.openEuler-24.03-LTS:否
5.openEuler-24.03-LTS-Next:否
6.openEuler-22.03-LTS-SP4:否
7.openEuler-24.03-LTS-SP1:否

===========================================================

@sanglipeng 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 分析项目 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()It malicious user provides a small pptable through sysfs and thena bigger pptable, it may cause buffer overflow attack in functionsmu_sys_set_pp_table().|
|已分析|2.openEulerScore|7.8|
|已分析|3.openEulerVector|AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H|
|已分析|4.受影响版本排查|openEuler-20.03-LTS-SP4:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-22.03-LTS-SP4:受影响,openEuler-24.03-LTS:受影响,openEuler-24.03-LTS-SP1:受影响,master:不受影响,openEuler-24.03-LTS-Next:不受影响|
|已分析|5.是否涉及abi变化|openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP3:否,master:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否,openEuler-24.03-LTS-SP1:否|
|已分析|6.原因说明|openEuler-20.03-LTS-SP4:正常修复,openEuler-22.03-LTS-SP3:正常修复,openEuler-22.03-LTS-SP4:正常修复,openEuler-24.03-LTS:正常修复,openEuler-24.03-LTS-SP1:正常修复,master:不受影响-漏洞代码不能被攻击者触发,openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

CVE-2025-21780

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()

It malicious user provides a small pptable through sysfs and then
a bigger pptable, it may cause buffer overflow attack in function
smu_sys_set_pp_table().

openEuler评分:(评分和向量)
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:受影响
2.openEuler-22.03-LTS-SP3:受影响
3.openEuler-22.03-LTS-SP4:受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS:受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:受影响

原因说明:
1.openEuler-20.03-LTS-SP4:正常修复
2.openEuler-22.03-LTS-SP3:正常修复
3.openEuler-22.03-LTS-SP4:正常修复
4.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS:正常修复
6.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1:正常修复

修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP3:否
3.master(23.08.5):否
4.openEuler-24.03-LTS:否
5.openEuler-24.03-LTS-Next:否
6.openEuler-22.03-LTS-SP4:否
7.openEuler-24.03-LTS-SP1:否

===========================================================

@sanglipeng 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态  | 分析项目 | 内容 |
|:--:|:--:|---------|
|已分析|1.影响性分析说明|In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()It malicious user provides a small pptable through sysfs and thena bigger pptable, it may cause buffer overflow attack in functionsmu_sys_set_pp_table().|
|已分析|2.openEulerScore|7.8|
|已分析|3.openEulerVector|AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H|
|已分析|4.受影响版本排查|openEuler-20.03-LTS-SP4:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-22.03-LTS-SP4:受影响,openEuler-24.03-LTS:受影响,openEuler-24.03-LTS-SP1:受影响,master:不受影响,openEuler-24.03-LTS-Next:不受影响|
|已分析|5.是否涉及abi变化|openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP3:否,master:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-Next:否,openEuler-22.03-LTS-SP4:否,openEuler-24.03-LTS-SP1:否|
|已分析|6.原因说明|openEuler-20.03-LTS-SP4:正常修复,openEuler-22.03-LTS-SP3:正常修复,openEuler-22.03-LTS-SP4:正常修复,openEuler-24.03-LTS:正常修复,openEuler-24.03-LTS-SP1:正常修复,master:不受影响-漏洞代码不能被攻击者触发,openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发|

**请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.**

主线引入问题补丁
289921b03fe5e288cf924a52018f075e1b94f446 drm/amd/powerplay: implement sysfs of pp_table for smu11 (v2)

影响和风险

该漏洞可能导致缓冲区溢出，进而引发内核内存破坏。恶意用户可以先提供一个较小的pptable，然后再提供一个较大的pptable，可能会攻击到amdgpu驱动的内存，最终实现提权或破坏系统稳定性。

利用条件

触发场景:当用户通过sysfs接口向amdgpu驱动提供一个较小的pptable，然后再提供一个较大的pptable时，就可能触发缓冲区溢出。

这需要用户在本地有一定的权限，能写入amdgpu驱动在sysfs下导出的文件节点。对于一般用户而言，默认情况下是没有这个权限的。但如果管理员错误地放开了对该接口的写权限，就可能被本地用户利用。

所以该漏洞的利用门槛相对较高，主要影响使用amdgpu显卡且管理员配置不当的特定场景。

技术原因

漏洞出现在函数smu_sys_set_pp_table()中，该函数处理用户通过sysfs提供的pptable数据:

static int smu_sys_set_pp_table(void *handle,
				char *buf,
				size_t size)
{
	struct pp_header *header = (struct pp_header *)buf;
	struct amdgpu_smu_table *smu_table = handle;
	int ret = 0;

  ...

 	if (!smu_table->hardcode_pptable) {
		smu_table->hardcode_pptable = kzalloc(size, GFP_KERNEL);
		if (!smu_table->hardcode_pptable)
			return -ENOMEM;
	}

	memcpy(smu_table->hardcode_pptable, buf, size);
  ...
}

可以看到，如果smu_table->hardcode_pptable为空，就会分配一个大小为size的缓冲区，size由用户提供。

如果用户先提供一个较小的size，hardcode_pptable会分配一个较小的空间。然后用户再提供一个较大的size，由于hardcode_pptable已经分配，不会重新分配更大的空间，但还是会拷贝size大小的数据到hardcode_pptable中，造成缓冲区溢出。

修复方案是在拷贝前增加检查，如果新的size大于已分配的hardcode_pptable大小，则重新分配:

+	if (!smu_table->hardcode_pptable || smu_table->power_play_table_size < size) {
+		kfree(smu_table->hardcode_pptable);
		smu_table->hardcode_pptable = kzalloc(size, GFP_KERNEL);
		if (!smu_table->hardcode_pptable)
			return -ENOMEM;
	}

CVE-2025-21780

影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()

It malicious user provides a small pptable through sysfs and then
a bigger pptable, it may cause buffer overflow attack in function
smu_sys_set_pp_table().

The Linux kernel CVE team has assigned CVE-2025-21780 to this issue.

openEuler评分:(评分和向量)
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响):
1.master(6.1.0):不受影响
2.openEuler-20.03-LTS-SP4:不受影响
3.openEuler-22.03-LTS-SP3:受影响
4.openEuler-22.03-LTS-SP4:受影响
5.openEuler-24.03-LTS:受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:受影响

修复是否涉及abi变化(是/否)：
1.master(6.1.0):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP3:否
4.openEuler-22.03-LTS-SP4:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否

原因说明：
1.master(23.08.5):不受影响-漏洞代码不能被攻击者触发
2.openEuler-20.03-LTS-SP4:不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP3:正常修复
5.openEuler-22.03-LTS-SP4:正常修复
6.openEuler-24.03-LTS:正常修复
7.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP1:正常修复