From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?UTF-8?Q?Christian_K=c3=b6nig?= Date: Thu, 16 Jun 2016 08:39:42 +0000 Subject: Re: [patch v2] drm/amdgpu: missing bounds check in amdgpu_set_pp_force_state() Message-Id: <576265CE.1070809@amd.com> List-Id: References: <20160616083023.GA7046@mwanda> In-Reply-To: <20160616083023.GA7046@mwanda> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable To: Dan Carpenter , Alex Deucher Cc: Jammy Zhou , kernel-janitors@vger.kernel.org, dri-devel@lists.freedesktop.org, Geliang Tang , Eric Huang , Rex Zhu Am 16.06.2016 um 10:30 schrieb Dan Carpenter: > There is no limit on high "idx" can go. It should be less than > ARRAY_SIZE(data.states) which is 16. > > The "data" variable wasn't declared in that scope so I shifted the code > around a bit to make it work. Also I made "idx" unsigned. > > Fixes: f3898ea12fc1 ('drm/amd/powerplay: add some sysfs interfaces for po= werplay.') > Signed-off-by: Dan Carpenter Acked-by: Christian K=F6nig . > --- > v2: make idx unsigned > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd= /amdgpu/amdgpu_pm.c > index 589b36e..0e13d80 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c > @@ -270,30 +270,28 @@ static ssize_t amdgpu_set_pp_force_state(struct dev= ice *dev, > struct drm_device *ddev =3D dev_get_drvdata(dev); > struct amdgpu_device *adev =3D ddev->dev_private; > enum amd_pm_state_type state =3D 0; > - long idx; > + unsigned long idx; > int ret; > =20 > if (strlen(buf) =3D 1) > adev->pp_force_state_enabled =3D false; > - else { > - ret =3D kstrtol(buf, 0, &idx); > + else if (adev->pp_enabled) { > + struct pp_states_info data; > =20 > - if (ret) { > + ret =3D kstrtoul(buf, 0, &idx); > + if (ret || idx >=3D ARRAY_SIZE(data.states)) { > count =3D -EINVAL; > goto fail; > } > =20 > - if (adev->pp_enabled) { > - struct pp_states_info data; > - amdgpu_dpm_get_pp_num_states(adev, &data); > - state =3D data.states[idx]; > - /* only set user selected power states */ > - if (state !=3D POWER_STATE_TYPE_INTERNAL_BOOT && > - state !=3D POWER_STATE_TYPE_DEFAULT) { > - amdgpu_dpm_dispatch_task(adev, > - AMD_PP_EVENT_ENABLE_USER_STATE, &state, NULL); > - adev->pp_force_state_enabled =3D true; > - } > + amdgpu_dpm_get_pp_num_states(adev, &data); > + state =3D data.states[idx]; > + /* only set user selected power states */ > + if (state !=3D POWER_STATE_TYPE_INTERNAL_BOOT && > + state !=3D POWER_STATE_TYPE_DEFAULT) { > + amdgpu_dpm_dispatch_task(adev, > + AMD_PP_EVENT_ENABLE_USER_STATE, &state, NULL); > + adev->pp_force_state_enabled =3D true; > } > } > fail: -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" = in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?UTF-8?Q?Christian_K=c3=b6nig?= Subject: Re: [patch v2] drm/amdgpu: missing bounds check in amdgpu_set_pp_force_state() Date: Thu, 16 Jun 2016 10:39:42 +0200 Message-ID: <576265CE.1070809@amd.com> References: <20160616083023.GA7046@mwanda> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8"; Format="flowed" Content-Transfer-Encoding: base64 Return-path: Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1bon0082.outbound.protection.outlook.com [157.56.111.82]) by gabe.freedesktop.org (Postfix) with ESMTPS id F1C836E251 for ; Thu, 16 Jun 2016 08:55:05 +0000 (UTC) In-Reply-To: <20160616083023.GA7046@mwanda> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Dan Carpenter , Alex Deucher Cc: Jammy Zhou , kernel-janitors@vger.kernel.org, dri-devel@lists.freedesktop.org, Geliang Tang , Eric Huang , Rex Zhu List-Id: dri-devel@lists.freedesktop.org QW0gMTYuMDYuMjAxNiB1bSAxMDozMCBzY2hyaWViIERhbiBDYXJwZW50ZXI6Cj4gVGhlcmUgaXMg bm8gbGltaXQgb24gaGlnaCAiaWR4IiBjYW4gZ28uICBJdCBzaG91bGQgYmUgbGVzcyB0aGFuCj4g QVJSQVlfU0laRShkYXRhLnN0YXRlcykgd2hpY2ggaXMgMTYuCj4KPiBUaGUgImRhdGEiIHZhcmlh YmxlIHdhc24ndCBkZWNsYXJlZCBpbiB0aGF0IHNjb3BlIHNvIEkgc2hpZnRlZCB0aGUgY29kZQo+ IGFyb3VuZCBhIGJpdCB0byBtYWtlIGl0IHdvcmsuICBBbHNvIEkgbWFkZSAiaWR4IiB1bnNpZ25l ZC4KPgo+IEZpeGVzOiBmMzg5OGVhMTJmYzEgKCdkcm0vYW1kL3Bvd2VycGxheTogYWRkIHNvbWUg c3lzZnMgaW50ZXJmYWNlcyBmb3IgcG93ZXJwbGF5LicpCj4gU2lnbmVkLW9mZi1ieTogRGFuIENh cnBlbnRlciA8ZGFuLmNhcnBlbnRlckBvcmFjbGUuY29tPgoKQWNrZWQtYnk6IENocmlzdGlhbiBL w7ZuaWcgPGNocmlzdGlhbi5rb2VuaWdAYW1kLmNvbT4uCgo+IC0tLQo+IHYyOiBtYWtlIGlkeCB1 bnNpZ25lZAo+Cj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvZ3B1L2RybS9hbWQvYW1kZ3B1L2FtZGdw dV9wbS5jIGIvZHJpdmVycy9ncHUvZHJtL2FtZC9hbWRncHUvYW1kZ3B1X3BtLmMKPiBpbmRleCA1 ODliMzZlLi4wZTEzZDgwIDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMvZ3B1L2RybS9hbWQvYW1kZ3B1 L2FtZGdwdV9wbS5jCj4gKysrIGIvZHJpdmVycy9ncHUvZHJtL2FtZC9hbWRncHUvYW1kZ3B1X3Bt LmMKPiBAQCAtMjcwLDMwICsyNzAsMjggQEAgc3RhdGljIHNzaXplX3QgYW1kZ3B1X3NldF9wcF9m b3JjZV9zdGF0ZShzdHJ1Y3QgZGV2aWNlICpkZXYsCj4gICAJc3RydWN0IGRybV9kZXZpY2UgKmRk ZXYgPSBkZXZfZ2V0X2RydmRhdGEoZGV2KTsKPiAgIAlzdHJ1Y3QgYW1kZ3B1X2RldmljZSAqYWRl diA9IGRkZXYtPmRldl9wcml2YXRlOwo+ICAgCWVudW0gYW1kX3BtX3N0YXRlX3R5cGUgc3RhdGUg PSAwOwo+IC0JbG9uZyBpZHg7Cj4gKwl1bnNpZ25lZCBsb25nIGlkeDsKPiAgIAlpbnQgcmV0Owo+ ICAgCj4gICAJaWYgKHN0cmxlbihidWYpID09IDEpCj4gICAJCWFkZXYtPnBwX2ZvcmNlX3N0YXRl X2VuYWJsZWQgPSBmYWxzZTsKPiAtCWVsc2Ugewo+IC0JCXJldCA9IGtzdHJ0b2woYnVmLCAwLCAm aWR4KTsKPiArCWVsc2UgaWYgKGFkZXYtPnBwX2VuYWJsZWQpIHsKPiArCQlzdHJ1Y3QgcHBfc3Rh dGVzX2luZm8gZGF0YTsKPiAgIAo+IC0JCWlmIChyZXQpIHsKPiArCQlyZXQgPSBrc3RydG91bChi dWYsIDAsICZpZHgpOwo+ICsJCWlmIChyZXQgfHwgaWR4ID49IEFSUkFZX1NJWkUoZGF0YS5zdGF0 ZXMpKSB7Cj4gICAJCQljb3VudCA9IC1FSU5WQUw7Cj4gICAJCQlnb3RvIGZhaWw7Cj4gICAJCX0K PiAgIAo+IC0JCWlmIChhZGV2LT5wcF9lbmFibGVkKSB7Cj4gLQkJCXN0cnVjdCBwcF9zdGF0ZXNf aW5mbyBkYXRhOwo+IC0JCQlhbWRncHVfZHBtX2dldF9wcF9udW1fc3RhdGVzKGFkZXYsICZkYXRh KTsKPiAtCQkJc3RhdGUgPSBkYXRhLnN0YXRlc1tpZHhdOwo+IC0JCQkvKiBvbmx5IHNldCB1c2Vy IHNlbGVjdGVkIHBvd2VyIHN0YXRlcyAqLwo+IC0JCQlpZiAoc3RhdGUgIT0gUE9XRVJfU1RBVEVf VFlQRV9JTlRFUk5BTF9CT09UICYmCj4gLQkJCQlzdGF0ZSAhPSBQT1dFUl9TVEFURV9UWVBFX0RF RkFVTFQpIHsKPiAtCQkJCWFtZGdwdV9kcG1fZGlzcGF0Y2hfdGFzayhhZGV2LAo+IC0JCQkJCQlB TURfUFBfRVZFTlRfRU5BQkxFX1VTRVJfU1RBVEUsICZzdGF0ZSwgTlVMTCk7Cj4gLQkJCQlhZGV2 LT5wcF9mb3JjZV9zdGF0ZV9lbmFibGVkID0gdHJ1ZTsKPiAtCQkJfQo+ICsJCWFtZGdwdV9kcG1f Z2V0X3BwX251bV9zdGF0ZXMoYWRldiwgJmRhdGEpOwo+ICsJCXN0YXRlID0gZGF0YS5zdGF0ZXNb aWR4XTsKPiArCQkvKiBvbmx5IHNldCB1c2VyIHNlbGVjdGVkIHBvd2VyIHN0YXRlcyAqLwo+ICsJ CWlmIChzdGF0ZSAhPSBQT1dFUl9TVEFURV9UWVBFX0lOVEVSTkFMX0JPT1QgJiYKPiArCQkgICAg c3RhdGUgIT0gUE9XRVJfU1RBVEVfVFlQRV9ERUZBVUxUKSB7Cj4gKwkJCWFtZGdwdV9kcG1fZGlz cGF0Y2hfdGFzayhhZGV2LAo+ICsJCQkJCUFNRF9QUF9FVkVOVF9FTkFCTEVfVVNFUl9TVEFURSwg JnN0YXRlLCBOVUxMKTsKPiArCQkJYWRldi0+cHBfZm9yY2Vfc3RhdGVfZW5hYmxlZCA9IHRydWU7 Cj4gICAJCX0KPiAgIAl9Cj4gICBmYWlsOgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18KZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMu ZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlz dGluZm8vZHJpLWRldmVsCg==