| Message ID | YOAsdyWeZAHF0oll@mwanda (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/4] drm/amdgpu: fix a signedness bug in __verify_ras_table_checksum() | expand |
Series is, Reviewed-by: Luben Tuikov <luben.tuikov@amd.com> Regards, Luben On 2021-07-03 5:44 a.m., Dan Carpenter wrote: > If amdgpu_eeprom_read() returns a negative error code then the error > handling checks: > > if (res < buf_size) { > > The problem is that "buf_size" is a u32 so negative values are type > promoted to a high positive values and the condition is false. Fix > this by changing the type of "buf_size" to int. > > Fixes: 79beb6114014 ("drm/amdgpu: Optimize EEPROM RAS table I/O") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > It's hard for me to tell the exact upper bound that "buf_size" can be, > but if it's over USHRT_MAX then we are well toasted. > > drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c > index fc70620369e4..f07a456506ef 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c > @@ -978,9 +978,8 @@ const struct file_operations amdgpu_ras_debugfs_eeprom_table_ops = { > static int __verify_ras_table_checksum(struct amdgpu_ras_eeprom_control *control) > { > struct amdgpu_device *adev = to_amdgpu_device(control); > - int res; > + int buf_size, res; > u8 csum, *buf, *pp; > - u32 buf_size; > > buf_size = RAS_TABLE_HEADER_SIZE + > control->ras_num_recs * RAS_TABLE_RECORD_SIZE;
Alex, I think we should pull these through amd-staging-drm-next. Regards, Luben On 2021-07-04 11:18 a.m., Luben Tuikov wrote: > Series is, > Reviewed-by: Luben Tuikov <luben.tuikov@amd.com> > > Regards, > Luben > > On 2021-07-03 5:44 a.m., Dan Carpenter wrote: >> If amdgpu_eeprom_read() returns a negative error code then the error >> handling checks: >> >> if (res < buf_size) { >> >> The problem is that "buf_size" is a u32 so negative values are type >> promoted to a high positive values and the condition is false. Fix >> this by changing the type of "buf_size" to int. >> >> Fixes: 79beb6114014 ("drm/amdgpu: Optimize EEPROM RAS table I/O") >> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> >> --- >> It's hard for me to tell the exact upper bound that "buf_size" can be, >> but if it's over USHRT_MAX then we are well toasted. >> >> drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 3 +-- >> 1 file changed, 1 insertion(+), 2 deletions(-) >> >> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c >> index fc70620369e4..f07a456506ef 100644 >> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c >> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c >> @@ -978,9 +978,8 @@ const struct file_operations amdgpu_ras_debugfs_eeprom_table_ops = { >> static int __verify_ras_table_checksum(struct amdgpu_ras_eeprom_control *control) >> { >> struct amdgpu_device *adev = to_amdgpu_device(control); >> - int res; >> + int buf_size, res; >> u8 csum, *buf, *pp; >> - u32 buf_size; >> >> buf_size = RAS_TABLE_HEADER_SIZE + >> control->ras_num_recs * RAS_TABLE_RECORD_SIZE;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c index fc70620369e4..f07a456506ef 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c @@ -978,9 +978,8 @@ const struct file_operations amdgpu_ras_debugfs_eeprom_table_ops = { static int __verify_ras_table_checksum(struct amdgpu_ras_eeprom_control *control) { struct amdgpu_device *adev = to_amdgpu_device(control); - int res; + int buf_size, res; u8 csum, *buf, *pp; - u32 buf_size; buf_size = RAS_TABLE_HEADER_SIZE + control->ras_num_recs * RAS_TABLE_RECORD_SIZE;
If amdgpu_eeprom_read() returns a negative error code then the error handling checks: if (res < buf_size) { The problem is that "buf_size" is a u32 so negative values are type promoted to a high positive values and the condition is false. Fix this by changing the type of "buf_size" to int. Fixes: 79beb6114014 ("drm/amdgpu: Optimize EEPROM RAS table I/O") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- It's hard for me to tell the exact upper bound that "buf_size" can be, but if it's over USHRT_MAX then we are well toasted. drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)