* [PATCH] amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
@ 2022-11-15 12:56 ` Dan Carpenter
0 siblings, 0 replies; 5+ messages in thread
From: Dan Carpenter @ 2022-11-15 12:56 UTC (permalink / raw)
To: Evan Quan
Cc: David Airlie, Pan, Xinhui, kernel-janitors, amd-gfx, dri-devel,
Daniel Vetter, Darren Powell, Alex Deucher, Lang Yu,
Christian König
In the PP_OD_EDIT_VDDC_CURVE case the "input_index" variable is capped at
2 but not checked for negative values so it results in an out of bounds
read. This value comes from the user via sysfs.
Fixes: d5bf26539494 ("drm/amd/powerplay: added vega20 overdrive support V3")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
index 97b3ad369046..b30684c84e20 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
@@ -2961,7 +2961,8 @@ static int vega20_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
data->od8_settings.od8_settings_array;
OverDriveTable_t *od_table =
&(data->smc_state_table.overdrive_table);
- int32_t input_index, input_clk, input_vol, i;
+ int32_t input_clk, input_vol, i;
+ uint32_t input_index;
int od8_id;
int ret;
--
2.35.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH] amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
@ 2022-11-15 12:56 ` Dan Carpenter
0 siblings, 0 replies; 5+ messages in thread
From: Dan Carpenter @ 2022-11-15 12:56 UTC (permalink / raw)
To: Evan Quan
Cc: Alex Deucher, Christian König, Pan, Xinhui, David Airlie,
Daniel Vetter, Lang Yu, Darren Powell, amd-gfx, dri-devel,
kernel-janitors
In the PP_OD_EDIT_VDDC_CURVE case the "input_index" variable is capped at
2 but not checked for negative values so it results in an out of bounds
read. This value comes from the user via sysfs.
Fixes: d5bf26539494 ("drm/amd/powerplay: added vega20 overdrive support V3")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
index 97b3ad369046..b30684c84e20 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
@@ -2961,7 +2961,8 @@ static int vega20_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
data->od8_settings.od8_settings_array;
OverDriveTable_t *od_table =
&(data->smc_state_table.overdrive_table);
- int32_t input_index, input_clk, input_vol, i;
+ int32_t input_clk, input_vol, i;
+ uint32_t input_index;
int od8_id;
int ret;
--
2.35.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH] amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
@ 2022-11-15 12:56 ` Dan Carpenter
0 siblings, 0 replies; 5+ messages in thread
From: Dan Carpenter @ 2022-11-15 12:56 UTC (permalink / raw)
To: Evan Quan
Cc: Pan, Xinhui, kernel-janitors, amd-gfx, dri-devel, Darren Powell,
Alex Deucher, Lang Yu, Christian König
In the PP_OD_EDIT_VDDC_CURVE case the "input_index" variable is capped at
2 but not checked for negative values so it results in an out of bounds
read. This value comes from the user via sysfs.
Fixes: d5bf26539494 ("drm/amd/powerplay: added vega20 overdrive support V3")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
index 97b3ad369046..b30684c84e20 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
@@ -2961,7 +2961,8 @@ static int vega20_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
data->od8_settings.od8_settings_array;
OverDriveTable_t *od_table =
&(data->smc_state_table.overdrive_table);
- int32_t input_index, input_clk, input_vol, i;
+ int32_t input_clk, input_vol, i;
+ uint32_t input_index;
int od8_id;
int ret;
--
2.35.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
2022-11-15 12:56 ` Dan Carpenter
@ 2022-11-15 14:48 ` Alex Deucher
-1 siblings, 0 replies; 5+ messages in thread
From: Alex Deucher @ 2022-11-15 14:48 UTC (permalink / raw)
To: Dan Carpenter
Cc: Pan, Xinhui, kernel-janitors, dri-devel, amd-gfx, Darren Powell,
Alex Deucher, Evan Quan, Lang Yu, Christian König
Applied. Thanks!
Alex
On Tue, Nov 15, 2022 at 7:57 AM Dan Carpenter <error27@gmail.com> wrote:
>
> In the PP_OD_EDIT_VDDC_CURVE case the "input_index" variable is capped at
> 2 but not checked for negative values so it results in an out of bounds
> read. This value comes from the user via sysfs.
>
> Fixes: d5bf26539494 ("drm/amd/powerplay: added vega20 overdrive support V3")
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
> drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
> index 97b3ad369046..b30684c84e20 100644
> --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
> +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
> @@ -2961,7 +2961,8 @@ static int vega20_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
> data->od8_settings.od8_settings_array;
> OverDriveTable_t *od_table =
> &(data->smc_state_table.overdrive_table);
> - int32_t input_index, input_clk, input_vol, i;
> + int32_t input_clk, input_vol, i;
> + uint32_t input_index;
> int od8_id;
> int ret;
>
> --
> 2.35.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
@ 2022-11-15 14:48 ` Alex Deucher
0 siblings, 0 replies; 5+ messages in thread
From: Alex Deucher @ 2022-11-15 14:48 UTC (permalink / raw)
To: Dan Carpenter
Cc: Evan Quan, Pan, Xinhui, kernel-janitors, amd-gfx, dri-devel,
Darren Powell, Alex Deucher, Lang Yu, Christian König
Applied. Thanks!
Alex
On Tue, Nov 15, 2022 at 7:57 AM Dan Carpenter <error27@gmail.com> wrote:
>
> In the PP_OD_EDIT_VDDC_CURVE case the "input_index" variable is capped at
> 2 but not checked for negative values so it results in an out of bounds
> read. This value comes from the user via sysfs.
>
> Fixes: d5bf26539494 ("drm/amd/powerplay: added vega20 overdrive support V3")
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
> drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
> index 97b3ad369046..b30684c84e20 100644
> --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
> +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
> @@ -2961,7 +2961,8 @@ static int vega20_odn_edit_dpm_table(struct pp_hwmgr *hwmgr,
> data->od8_settings.od8_settings_array;
> OverDriveTable_t *od_table =
> &(data->smc_state_table.overdrive_table);
> - int32_t input_index, input_clk, input_vol, i;
> + int32_t input_clk, input_vol, i;
> + uint32_t input_index;
> int od8_id;
> int ret;
>
> --
> 2.35.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-11-15 14:49 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-11-15 12:56 [PATCH] amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() Dan Carpenter
2022-11-15 12:56 ` Dan Carpenter
2022-11-15 12:56 ` Dan Carpenter
2022-11-15 14:48 ` Alex Deucher
2022-11-15 14:48 ` Alex Deucher
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.