lkml.org 
[lkml]   [2021]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 098/247] drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit c915ef890d5dc79f483e1ca3b3a5b5f1a170690c ]

    If the user passes a "level" value which is higher than 31 then that
    leads to shift wrapping. The undefined behavior will lead to a
    syzkaller stack dump.

    Fixes: 5632708f4452 ("drm/amd/powerplay: add dpm force multiple levels on cz/tonga/fiji/polaris (v2)")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
    index e63a253eb4255..cbb969a870f6a 100644
    --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
    +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
    @@ -617,7 +617,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev,
    static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
    {
    int ret;
    - long level;
    + unsigned long level;
    char *sub_str = NULL;
    char *tmp;
    char buf_cpy[AMDGPU_MASK_BUF_MAX + 1];
    @@ -633,8 +633,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
    while (tmp[0]) {
    sub_str = strsep(&tmp, delimiter);
    if (strlen(sub_str)) {
    - ret = kstrtol(sub_str, 0, &level);
    - if (ret)
    + ret = kstrtoul(sub_str, 0, &level);
    + if (ret || level > 31)
    return -EINVAL;
    *mask |= 1 << level;
    } else
    --
    2.27.0


    \
     
     \ /
      Last update: 2021-03-01 21:42    [W:2.511 / U:0.500 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site