From patchwork Wed Apr 19 12:20:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: whitehat002 whitehat002 X-Patchwork-Id: 676462 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C18DEC77B75 for ; Wed, 19 Apr 2023 12:22:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232250AbjDSMWk (ORCPT ); Wed, 19 Apr 2023 08:22:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41178 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233252AbjDSMW1 (ORCPT ); Wed, 19 Apr 2023 08:22:27 -0400 Received: from mail-pl1-x632.google.com (mail-pl1-x632.google.com [IPv6:2607:f8b0:4864:20::632]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D69E173B; Wed, 19 Apr 2023 05:22:23 -0700 (PDT) Received: by mail-pl1-x632.google.com with SMTP id n17so12541377pln.8; Wed, 19 Apr 2023 05:22:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1681906943; x=1684498943; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Cvi/8BFVMUmJHt4WjuHDaXoszJBRcvvbnSWyynNb4dw=; b=M3A9a6WtOWXdYHHcfybW8ymSEnpEjD5R0HfAB1fZbrJ4eb18z3BbaIQkiZch+E3XFN gtImBttegWoB8LCoLFNJDhiiSl267YU1V1Nsc33I4Y18p03z0gGfjf/VdKUhfjZcBXD5 aq+woQSFxs2Vu2JdQq610eO1TMJ0DviQoiqjfPoAGc/JAkBZ7fiCJzgpbt/FhH5BE7Zm 0vjqLsxUHKPd4lYUtp5GXOSKExiXmujz3dv9bAp68j4aoXlww1GZg/PJ3faT06bwcuTO 4QQaNsK1vvXfQuNxUKLhbD5rkeXzfHeIk527XpKrudr38a8q5hrfpyRQWEWtLb0bfx1u 1w9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1681906943; x=1684498943; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Cvi/8BFVMUmJHt4WjuHDaXoszJBRcvvbnSWyynNb4dw=; b=dEL2psCi52nerBPpJYJmIxPgx4rE5Yxnrg5tG/AJ3kCpo6QcLIvlAl4Qh1n/O4ovt9 yKThd1Cx0Ae/te8Bnkd4XqAe3E/DkA6tEhs7tC3tuNhjN48zvS/ajx87dI/H4aNVPfyA Jtdg9UzInBsY4/ZbO/e6OBQ7P2FkVNZRM1spev9goItJg0WXf5zblHh/jog3ftH+wgvm NltPyCTgp/TbHPKgd+aGZjpBc9mFMtfa1cl1u14B91ZPj35pYmJsXF8DSw4fkW4fydAx 6RSeuCPzrxkwHtN65SWU9lb67PIoNCNEHu/9+CpW8u/f9CdHgr8I7L2+EQU1D0x7MEmp H51Q== X-Gm-Message-State: AAQBX9c4EgsfXqzZqB08brvB89AOzmR2lw54/nYnoldFZW3jJHFme5yB wtszhiHzQYdlkzoG+nEz+zs= X-Google-Smtp-Source: AKy350YunIiQ3rSxoOx6P/gwromJ6KqxNFKy+BHVTeuXJi6xVHlbz9D1gBHrAJqbGAdA5qNa2rmVAg== X-Received: by 2002:a05:6a20:3d1a:b0:ee:7694:f069 with SMTP id y26-20020a056a203d1a00b000ee7694f069mr3643470pzi.41.1681906942789; Wed, 19 Apr 2023 05:22:22 -0700 (PDT) Received: from hackyzh-virtual-machine.localdomain ([112.64.53.154]) by smtp.gmail.com with ESMTPSA id ft2-20020a17090b0f8200b002471f34d5ddsm1279106pjb.55.2023.04.19.05.22.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Apr 2023 05:22:22 -0700 (PDT) From: hackyzh002 To: alexander.deucher@amd.com Cc: christian.koenig@amd.com, Xinhui.Pan@amd.com, airlied@gmail.com, daniel@ffwll.ch, sumit.semwal@linaro.org, amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, linaro-mm-sig@lists.linaro.org, hackyzh002 Subject: [PATCH V3 1/2] drm/radeon: Fix integer overflow in radeon_cs_parser_init Date: Wed, 19 Apr 2023 20:20:58 +0800 Message-Id: <20230419122058.3420-1-hackyzh002@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org The type of size is unsigned, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later Signed-off-by: hackyzh002 --- drivers/gpu/drm/radeon/radeon_cs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c index 46a27ebf4..a6700d727 100644 --- a/drivers/gpu/drm/radeon/radeon_cs.c +++ b/drivers/gpu/drm/radeon/radeon_cs.c @@ -270,7 +270,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) { struct drm_radeon_cs *cs = data; uint64_t *chunk_array_ptr; - unsigned size, i; + u64 size; + unsigned i; u32 ring = RADEON_CS_RING_GFX; s32 priority = 0; From patchwork Wed Apr 19 12:22:33 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: whitehat002 whitehat002 X-Patchwork-Id: 675469 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AB7B4C6FD18 for ; Wed, 19 Apr 2023 12:23:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232834AbjDSMXN (ORCPT ); Wed, 19 Apr 2023 08:23:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41624 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232540AbjDSMXM (ORCPT ); Wed, 19 Apr 2023 08:23:12 -0400 Received: from mail-pl1-x631.google.com (mail-pl1-x631.google.com [IPv6:2607:f8b0:4864:20::631]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 75D51173B; Wed, 19 Apr 2023 05:23:11 -0700 (PDT) Received: by mail-pl1-x631.google.com with SMTP id d9443c01a7336-1a6ebc66ca4so15305505ad.3; Wed, 19 Apr 2023 05:23:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1681906991; x=1684498991; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=vuo1R6zgWP4V7fxSrNGqI53skR4NUxsCW4UKtSQFHoQ=; b=iHj2EFKwjqQG5zGuh91t/HLTjhn98+Tm/JgEUgdtKzQYUcMmigmjFwJZQ27nAG8Bnn RHiWrB3TM8X4DXmmFUxo4NXSXOgDWYjPdgXCG/SYRg/5s9pd4KEAOJnc20QtgnF8qg52 AUf1b2vXcFFtExWm9wshnbebzGLoILPKk6KmWinlkzij5YLgVKCJ7g26LmkyIfbTFQqg FLt59XmV42XHJ8E+dQGIJaHimuxqMmRFmogeMWa+pdUIzr2GIVnbyyyvr0DFJqmTfMVp 0L9i+faJHasd1uXPnVTW5t6+PMtY5Nt+W/N4+KxTV6QfESQ7rL+ImLHb+Q4igKn6JFDk v/TA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1681906991; x=1684498991; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=vuo1R6zgWP4V7fxSrNGqI53skR4NUxsCW4UKtSQFHoQ=; b=WBTotO6ilhFoPv7Pgkrv7LyjG1vddWCnA7O7MP2f5IXW0/S8np961SYxTC3bZbPJ6y ENBOtSkbQt7nzk6OlI2mzLnQHHFvQTFwGPFTZTG/CHgpsUldqo5yLi8t4QRXjfygqF/k pasuFJXng208wYZwyrgZ+RPbDsoLeWj/uA3nACfam2kSgpgkFOUoMKqOBQpucku+I46R X+V/4op//PG6D25WZSl4nZ+7mv6SBtuhT8KQfBsHlNFLbcZ64A/KMiHJnQKqQaKM11L3 f0MfcuoBaxZBBJwFDBEAlUP7nL+nl+tSqNDqklKVjYhi3L98TaecRRGbSfxkcnQ2OvuD 8vPQ== X-Gm-Message-State: AAQBX9dQodrNQmJIDoLMNwyMnaoX+wJ+G8JAC8UTkRUdnHVoVT4362+8 sfkFdUTKppJqTYw0OKyOh6I= X-Google-Smtp-Source: AKy350ZOvvzEVtaSNhWFtkSL5aX841ukA5rD+bJ6S5wFb5ZiUTOGTwRiL0CFdwfo4kCozHg/35yMcw== X-Received: by 2002:a17:902:c410:b0:1a1:f0ad:8657 with SMTP id k16-20020a170902c41000b001a1f0ad8657mr7207596plk.37.1681906990803; Wed, 19 Apr 2023 05:23:10 -0700 (PDT) Received: from hackyzh-virtual-machine.localdomain ([112.64.53.154]) by smtp.gmail.com with ESMTPSA id l11-20020a170902d34b00b0019c32968271sm9053670plk.11.2023.04.19.05.23.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Apr 2023 05:23:10 -0700 (PDT) From: hackyzh002 To: alexander.deucher@amd.com Cc: christian.koenig@amd.com, Xinhui.Pan@amd.com, airlied@gmail.com, daniel@ffwll.ch, sumit.semwal@linaro.org, amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, linaro-mm-sig@lists.linaro.org, hackyzh002 Subject: [PATCH v3 2/2] drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 Date: Wed, 19 Apr 2023 20:22:33 +0800 Message-Id: <20230419122233.3440-1-hackyzh002@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org The type of size is unsigned int, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later. Signed-off-by: hackyzh002 --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index 08eced097..89bcacc65 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -192,7 +192,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, uint64_t *chunk_array_user; uint64_t *chunk_array; uint32_t uf_offset = 0; - unsigned int size; + size_t size; int ret; int i;