| Message ID | 20230419082705.4110-1-hackyzh002@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | None | expand |
Am 19.04.23 um 10:27 schrieb hackyzh002: > The type of size is unsigned int, if size is 0x40000000, there will > be an integer overflow, size will be zero after size *= sizeof(uint32_t), > will cause uninitialized memory to be referenced later. > > Signed-off-by: hackyzh002 <hackyzh002@gmail.com> > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c > index 08eced097..c17b3af85 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c > @@ -192,7 +192,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, > uint64_t *chunk_array_user; > uint64_t *chunk_array; > uint32_t uf_offset = 0; > - unsigned int size; > + size_t size; > int ret; > int i; > > @@ -235,7 +235,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, > size = p->chunks[i].length_dw; > cdata = u64_to_user_ptr(user_chunk.chunk_data); > > - p->chunks[i].kdata = kvmalloc_array(size, sizeof(uint32_t), > + p->chunks[i].kdata = kvcalloc(size, sizeof(uint32_t), Again, please drop that part of the patch. This is superfluous. Regards, Christian. > GFP_KERNEL); > if (p->chunks[i].kdata == NULL) { > ret = -ENOMEM;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index 08eced097..c17b3af85 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -192,7 +192,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, uint64_t *chunk_array_user; uint64_t *chunk_array; uint32_t uf_offset = 0; - unsigned int size; + size_t size; int ret; int i; @@ -235,7 +235,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, size = p->chunks[i].length_dw; cdata = u64_to_user_ptr(user_chunk.chunk_data); - p->chunks[i].kdata = kvmalloc_array(size, sizeof(uint32_t), + p->chunks[i].kdata = kvcalloc(size, sizeof(uint32_t), GFP_KERNEL); if (p->chunks[i].kdata == NULL) { ret = -ENOMEM;
The type of size is unsigned int, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later. Signed-off-by: hackyzh002 <hackyzh002@gmail.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)