* [PATCH] drm/amd/pm: Fix memory some memory corruption
@ 2023-06-06 8:33 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2023-06-06 8:33 UTC (permalink / raw)
To: Evan Quan
Cc: Horatio Zhang, Pan, Xinhui, Yang Wang, Kenneth Feng, Lijo Lazar,
kernel-janitors, amd-gfx, YiPeng Chai, Daniel Vetter,
Alex Deucher, Candice Li, David Airlie, Christian König,
Hawking Zhang
The "od_table" is a pointer to a large struct, but this code is doing
pointer math as if it were pointing to bytes. It results in writing
far outside the struct.
Fixes: f0a0c659fb96 ("drm/amd/pm: fulfill the OD support for SMU13.0.0")
Fixes: e3afa4f988b3 ("drm/amd/pm: fulfill the OD support for SMU13.0.7")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 4 ++--
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
index 5ac5ea770c1c..413e592f0ed6 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
@@ -1535,7 +1535,7 @@ static int smu_v13_0_0_od_edit_dpm_table(struct smu_context *smu,
* settings. Thus we do not cache it.
*/
offset_of_featurectrlmask = offsetof(OverDriveTable_t, FeatureCtrlMask);
- if (memcmp(od_table + offset_of_featurectrlmask,
+ if (memcmp((u8 *)od_table + offset_of_featurectrlmask,
table_context->user_overdrive_table + offset_of_featurectrlmask,
sizeof(OverDriveTableExternal_t) - offset_of_featurectrlmask)) {
smu_v13_0_0_dump_od_table(smu, od_table);
@@ -1548,7 +1548,7 @@ static int smu_v13_0_0_od_edit_dpm_table(struct smu_context *smu,
od_table->OverDriveTable.FeatureCtrlMask = 0;
memcpy(table_context->user_overdrive_table + offset_of_featurectrlmask,
- od_table + offset_of_featurectrlmask,
+ (u8 *)od_table + offset_of_featurectrlmask,
sizeof(OverDriveTableExternal_t) - offset_of_featurectrlmask);
if (!memcmp(table_context->user_overdrive_table,
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
index 0bd086360efa..cda4e818aab7 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
@@ -1524,7 +1524,7 @@ static int smu_v13_0_7_od_edit_dpm_table(struct smu_context *smu,
* settings. Thus we do not cache it.
*/
offset_of_featurectrlmask = offsetof(OverDriveTable_t, FeatureCtrlMask);
- if (memcmp(od_table + offset_of_featurectrlmask,
+ if (memcmp((u8 *)od_table + offset_of_featurectrlmask,
table_context->user_overdrive_table + offset_of_featurectrlmask,
sizeof(OverDriveTableExternal_t) - offset_of_featurectrlmask)) {
smu_v13_0_7_dump_od_table(smu, od_table);
@@ -1537,7 +1537,7 @@ static int smu_v13_0_7_od_edit_dpm_table(struct smu_context *smu,
od_table->OverDriveTable.FeatureCtrlMask = 0;
memcpy(table_context->user_overdrive_table + offset_of_featurectrlmask,
- od_table + offset_of_featurectrlmask,
+ (u8 *)od_table + offset_of_featurectrlmask,
sizeof(OverDriveTableExternal_t) - offset_of_featurectrlmask);
if (!memcmp(table_context->user_overdrive_table,
--
2.39.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] drm/amd/pm: Fix memory some memory corruption @ 2023-06-06 8:33 ` Dan Carpenter 0 siblings, 0 replies; 6+ messages in thread From: Dan Carpenter @ 2023-06-06 8:33 UTC (permalink / raw) To: Evan Quan Cc: Alex Deucher, Christian König, Pan, Xinhui, David Airlie, Daniel Vetter, Lijo Lazar, Hawking Zhang, Kenneth Feng, Candice Li, YiPeng Chai, Yang Wang, Horatio Zhang, amd-gfx, kernel-janitors The "od_table" is a pointer to a large struct, but this code is doing pointer math as if it were pointing to bytes. It results in writing far outside the struct. Fixes: f0a0c659fb96 ("drm/amd/pm: fulfill the OD support for SMU13.0.0") Fixes: e3afa4f988b3 ("drm/amd/pm: fulfill the OD support for SMU13.0.7") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 4 ++-- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c index 5ac5ea770c1c..413e592f0ed6 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c @@ -1535,7 +1535,7 @@ static int smu_v13_0_0_od_edit_dpm_table(struct smu_context *smu, * settings. Thus we do not cache it. */ offset_of_featurectrlmask = offsetof(OverDriveTable_t, FeatureCtrlMask); - if (memcmp(od_table + offset_of_featurectrlmask, + if (memcmp((u8 *)od_table + offset_of_featurectrlmask, table_context->user_overdrive_table + offset_of_featurectrlmask, sizeof(OverDriveTableExternal_t) - offset_of_featurectrlmask)) { smu_v13_0_0_dump_od_table(smu, od_table); @@ -1548,7 +1548,7 @@ static int smu_v13_0_0_od_edit_dpm_table(struct smu_context *smu, od_table->OverDriveTable.FeatureCtrlMask = 0; memcpy(table_context->user_overdrive_table + offset_of_featurectrlmask, - od_table + offset_of_featurectrlmask, + (u8 *)od_table + offset_of_featurectrlmask, sizeof(OverDriveTableExternal_t) - offset_of_featurectrlmask); if (!memcmp(table_context->user_overdrive_table, diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c index 0bd086360efa..cda4e818aab7 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c @@ -1524,7 +1524,7 @@ static int smu_v13_0_7_od_edit_dpm_table(struct smu_context *smu, * settings. Thus we do not cache it. */ offset_of_featurectrlmask = offsetof(OverDriveTable_t, FeatureCtrlMask); - if (memcmp(od_table + offset_of_featurectrlmask, + if (memcmp((u8 *)od_table + offset_of_featurectrlmask, table_context->user_overdrive_table + offset_of_featurectrlmask, sizeof(OverDriveTableExternal_t) - offset_of_featurectrlmask)) { smu_v13_0_7_dump_od_table(smu, od_table); @@ -1537,7 +1537,7 @@ static int smu_v13_0_7_od_edit_dpm_table(struct smu_context *smu, od_table->OverDriveTable.FeatureCtrlMask = 0; memcpy(table_context->user_overdrive_table + offset_of_featurectrlmask, - od_table + offset_of_featurectrlmask, + (u8 *)od_table + offset_of_featurectrlmask, sizeof(OverDriveTableExternal_t) - offset_of_featurectrlmask); if (!memcmp(table_context->user_overdrive_table, -- 2.39.2 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* RE: [PATCH] drm/amd/pm: Fix memory some memory corruption 2023-06-06 8:33 ` Dan Carpenter @ 2023-06-06 10:27 ` Quan, Evan -1 siblings, 0 replies; 6+ messages in thread From: Quan, Evan @ 2023-06-06 10:27 UTC (permalink / raw) To: Dan Carpenter Cc: Zhang, Horatio, Pan, Xinhui, Wang, Yang(Kevin), Feng, Kenneth, Lazar, Lijo, kernel-janitors@vger.kernel.org, amd-gfx@lists.freedesktop.org, Chai, Thomas, Daniel Vetter, Deucher, Alexander, Li, Candice, David Airlie, Koenig, Christian, Zhang, Hawking [AMD Official Use Only - General] Thanks for catching this. Reviewed-by: Evan Quan <evan.quan@amd.com> > -----Original Message----- > From: Dan Carpenter <dan.carpenter@linaro.org> > Sent: Tuesday, June 6, 2023 4:34 PM > To: Quan, Evan <Evan.Quan@amd.com> > Cc: Deucher, Alexander <Alexander.Deucher@amd.com>; Koenig, Christian > <Christian.Koenig@amd.com>; Pan, Xinhui <Xinhui.Pan@amd.com>; David > Airlie <airlied@gmail.com>; Daniel Vetter <daniel@ffwll.ch>; Lazar, Lijo > <Lijo.Lazar@amd.com>; Zhang, Hawking <Hawking.Zhang@amd.com>; Feng, > Kenneth <Kenneth.Feng@amd.com>; Li, Candice <Candice.Li@amd.com>; > Chai, Thomas <YiPeng.Chai@amd.com>; Wang, Yang(Kevin) > <KevinYang.Wang@amd.com>; Zhang, Horatio <Hongkun.Zhang@amd.com>; > amd-gfx@lists.freedesktop.org; kernel-janitors@vger.kernel.org > Subject: [PATCH] drm/amd/pm: Fix memory some memory corruption > > The "od_table" is a pointer to a large struct, but this code is doing pointer > math as if it were pointing to bytes. It results in writing far outside the struct. > > Fixes: f0a0c659fb96 ("drm/amd/pm: fulfill the OD support for SMU13.0.0") > Fixes: e3afa4f988b3 ("drm/amd/pm: fulfill the OD support for SMU13.0.7") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 4 ++-- > drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 4 ++-- > 2 files changed, 4 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > index 5ac5ea770c1c..413e592f0ed6 100644 > --- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > +++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > @@ -1535,7 +1535,7 @@ static int smu_v13_0_0_od_edit_dpm_table(struct > smu_context *smu, > * settings. Thus we do not cache it. > */ > offset_of_featurectrlmask = offsetof(OverDriveTable_t, > FeatureCtrlMask); > - if (memcmp(od_table + offset_of_featurectrlmask, > + if (memcmp((u8 *)od_table + offset_of_featurectrlmask, > table_context->user_overdrive_table + > offset_of_featurectrlmask, > sizeof(OverDriveTableExternal_t) - > offset_of_featurectrlmask)) { > smu_v13_0_0_dump_od_table(smu, od_table); @@ - > 1548,7 +1548,7 @@ static int smu_v13_0_0_od_edit_dpm_table(struct > smu_context *smu, > > od_table->OverDriveTable.FeatureCtrlMask = 0; > memcpy(table_context->user_overdrive_table + > offset_of_featurectrlmask, > - od_table + offset_of_featurectrlmask, > + (u8 *)od_table + offset_of_featurectrlmask, > sizeof(OverDriveTableExternal_t) - > offset_of_featurectrlmask); > > if (!memcmp(table_context->user_overdrive_table, > diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > index 0bd086360efa..cda4e818aab7 100644 > --- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > +++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > @@ -1524,7 +1524,7 @@ static int smu_v13_0_7_od_edit_dpm_table(struct > smu_context *smu, > * settings. Thus we do not cache it. > */ > offset_of_featurectrlmask = offsetof(OverDriveTable_t, > FeatureCtrlMask); > - if (memcmp(od_table + offset_of_featurectrlmask, > + if (memcmp((u8 *)od_table + offset_of_featurectrlmask, > table_context->user_overdrive_table + > offset_of_featurectrlmask, > sizeof(OverDriveTableExternal_t) - > offset_of_featurectrlmask)) { > smu_v13_0_7_dump_od_table(smu, od_table); @@ - > 1537,7 +1537,7 @@ static int smu_v13_0_7_od_edit_dpm_table(struct > smu_context *smu, > > od_table->OverDriveTable.FeatureCtrlMask = 0; > memcpy(table_context->user_overdrive_table + > offset_of_featurectrlmask, > - od_table + offset_of_featurectrlmask, > + (u8 *)od_table + offset_of_featurectrlmask, > sizeof(OverDriveTableExternal_t) - > offset_of_featurectrlmask); > > if (!memcmp(table_context->user_overdrive_table, > -- > 2.39.2 ^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: [PATCH] drm/amd/pm: Fix memory some memory corruption @ 2023-06-06 10:27 ` Quan, Evan 0 siblings, 0 replies; 6+ messages in thread From: Quan, Evan @ 2023-06-06 10:27 UTC (permalink / raw) To: Dan Carpenter Cc: Deucher, Alexander, Koenig, Christian, Pan, Xinhui, David Airlie, Daniel Vetter, Lazar, Lijo, Zhang, Hawking, Feng, Kenneth, Li, Candice, Chai, Thomas, Wang, Yang(Kevin), Zhang, Horatio, amd-gfx@lists.freedesktop.org, kernel-janitors@vger.kernel.org [AMD Official Use Only - General] Thanks for catching this. Reviewed-by: Evan Quan <evan.quan@amd.com> > -----Original Message----- > From: Dan Carpenter <dan.carpenter@linaro.org> > Sent: Tuesday, June 6, 2023 4:34 PM > To: Quan, Evan <Evan.Quan@amd.com> > Cc: Deucher, Alexander <Alexander.Deucher@amd.com>; Koenig, Christian > <Christian.Koenig@amd.com>; Pan, Xinhui <Xinhui.Pan@amd.com>; David > Airlie <airlied@gmail.com>; Daniel Vetter <daniel@ffwll.ch>; Lazar, Lijo > <Lijo.Lazar@amd.com>; Zhang, Hawking <Hawking.Zhang@amd.com>; Feng, > Kenneth <Kenneth.Feng@amd.com>; Li, Candice <Candice.Li@amd.com>; > Chai, Thomas <YiPeng.Chai@amd.com>; Wang, Yang(Kevin) > <KevinYang.Wang@amd.com>; Zhang, Horatio <Hongkun.Zhang@amd.com>; > amd-gfx@lists.freedesktop.org; kernel-janitors@vger.kernel.org > Subject: [PATCH] drm/amd/pm: Fix memory some memory corruption > > The "od_table" is a pointer to a large struct, but this code is doing pointer > math as if it were pointing to bytes. It results in writing far outside the struct. > > Fixes: f0a0c659fb96 ("drm/amd/pm: fulfill the OD support for SMU13.0.0") > Fixes: e3afa4f988b3 ("drm/amd/pm: fulfill the OD support for SMU13.0.7") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 4 ++-- > drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 4 ++-- > 2 files changed, 4 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > index 5ac5ea770c1c..413e592f0ed6 100644 > --- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > +++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > @@ -1535,7 +1535,7 @@ static int smu_v13_0_0_od_edit_dpm_table(struct > smu_context *smu, > * settings. Thus we do not cache it. > */ > offset_of_featurectrlmask = offsetof(OverDriveTable_t, > FeatureCtrlMask); > - if (memcmp(od_table + offset_of_featurectrlmask, > + if (memcmp((u8 *)od_table + offset_of_featurectrlmask, > table_context->user_overdrive_table + > offset_of_featurectrlmask, > sizeof(OverDriveTableExternal_t) - > offset_of_featurectrlmask)) { > smu_v13_0_0_dump_od_table(smu, od_table); @@ - > 1548,7 +1548,7 @@ static int smu_v13_0_0_od_edit_dpm_table(struct > smu_context *smu, > > od_table->OverDriveTable.FeatureCtrlMask = 0; > memcpy(table_context->user_overdrive_table + > offset_of_featurectrlmask, > - od_table + offset_of_featurectrlmask, > + (u8 *)od_table + offset_of_featurectrlmask, > sizeof(OverDriveTableExternal_t) - > offset_of_featurectrlmask); > > if (!memcmp(table_context->user_overdrive_table, > diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > index 0bd086360efa..cda4e818aab7 100644 > --- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > +++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > @@ -1524,7 +1524,7 @@ static int smu_v13_0_7_od_edit_dpm_table(struct > smu_context *smu, > * settings. Thus we do not cache it. > */ > offset_of_featurectrlmask = offsetof(OverDriveTable_t, > FeatureCtrlMask); > - if (memcmp(od_table + offset_of_featurectrlmask, > + if (memcmp((u8 *)od_table + offset_of_featurectrlmask, > table_context->user_overdrive_table + > offset_of_featurectrlmask, > sizeof(OverDriveTableExternal_t) - > offset_of_featurectrlmask)) { > smu_v13_0_7_dump_od_table(smu, od_table); @@ - > 1537,7 +1537,7 @@ static int smu_v13_0_7_od_edit_dpm_table(struct > smu_context *smu, > > od_table->OverDriveTable.FeatureCtrlMask = 0; > memcpy(table_context->user_overdrive_table + > offset_of_featurectrlmask, > - od_table + offset_of_featurectrlmask, > + (u8 *)od_table + offset_of_featurectrlmask, > sizeof(OverDriveTableExternal_t) - > offset_of_featurectrlmask); > > if (!memcmp(table_context->user_overdrive_table, > -- > 2.39.2 ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/amd/pm: Fix memory some memory corruption 2023-06-06 10:27 ` Quan, Evan @ 2023-06-06 19:27 ` Alex Deucher -1 siblings, 0 replies; 6+ messages in thread From: Alex Deucher @ 2023-06-06 19:27 UTC (permalink / raw) To: Quan, Evan Cc: Zhang, Horatio, Pan, Xinhui, Wang, Yang(Kevin), David Airlie, Lazar, Lijo, kernel-janitors@vger.kernel.org, amd-gfx@lists.freedesktop.org, Chai, Thomas, Daniel Vetter, Deucher, Alexander, Li, Candice, Feng, Kenneth, Koenig, Christian, Dan Carpenter, Zhang, Hawking Applied. Thanks! Alex On Tue, Jun 6, 2023 at 6:27 AM Quan, Evan <Evan.Quan@amd.com> wrote: > > [AMD Official Use Only - General] > > Thanks for catching this. > Reviewed-by: Evan Quan <evan.quan@amd.com> > > > -----Original Message----- > > From: Dan Carpenter <dan.carpenter@linaro.org> > > Sent: Tuesday, June 6, 2023 4:34 PM > > To: Quan, Evan <Evan.Quan@amd.com> > > Cc: Deucher, Alexander <Alexander.Deucher@amd.com>; Koenig, Christian > > <Christian.Koenig@amd.com>; Pan, Xinhui <Xinhui.Pan@amd.com>; David > > Airlie <airlied@gmail.com>; Daniel Vetter <daniel@ffwll.ch>; Lazar, Lijo > > <Lijo.Lazar@amd.com>; Zhang, Hawking <Hawking.Zhang@amd.com>; Feng, > > Kenneth <Kenneth.Feng@amd.com>; Li, Candice <Candice.Li@amd.com>; > > Chai, Thomas <YiPeng.Chai@amd.com>; Wang, Yang(Kevin) > > <KevinYang.Wang@amd.com>; Zhang, Horatio <Hongkun.Zhang@amd.com>; > > amd-gfx@lists.freedesktop.org; kernel-janitors@vger.kernel.org > > Subject: [PATCH] drm/amd/pm: Fix memory some memory corruption > > > > The "od_table" is a pointer to a large struct, but this code is doing pointer > > math as if it were pointing to bytes. It results in writing far outside the struct. > > > > Fixes: f0a0c659fb96 ("drm/amd/pm: fulfill the OD support for SMU13.0.0") > > Fixes: e3afa4f988b3 ("drm/amd/pm: fulfill the OD support for SMU13.0.7") > > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > > --- > > drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 4 ++-- > > drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 4 ++-- > > 2 files changed, 4 insertions(+), 4 deletions(-) > > > > diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > > b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > > index 5ac5ea770c1c..413e592f0ed6 100644 > > --- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > > +++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > > @@ -1535,7 +1535,7 @@ static int smu_v13_0_0_od_edit_dpm_table(struct > > smu_context *smu, > > * settings. Thus we do not cache it. > > */ > > offset_of_featurectrlmask = offsetof(OverDriveTable_t, > > FeatureCtrlMask); > > - if (memcmp(od_table + offset_of_featurectrlmask, > > + if (memcmp((u8 *)od_table + offset_of_featurectrlmask, > > table_context->user_overdrive_table + > > offset_of_featurectrlmask, > > sizeof(OverDriveTableExternal_t) - > > offset_of_featurectrlmask)) { > > smu_v13_0_0_dump_od_table(smu, od_table); @@ - > > 1548,7 +1548,7 @@ static int smu_v13_0_0_od_edit_dpm_table(struct > > smu_context *smu, > > > > od_table->OverDriveTable.FeatureCtrlMask = 0; > > memcpy(table_context->user_overdrive_table + > > offset_of_featurectrlmask, > > - od_table + offset_of_featurectrlmask, > > + (u8 *)od_table + offset_of_featurectrlmask, > > sizeof(OverDriveTableExternal_t) - > > offset_of_featurectrlmask); > > > > if (!memcmp(table_context->user_overdrive_table, > > diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > > b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > > index 0bd086360efa..cda4e818aab7 100644 > > --- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > > +++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > > @@ -1524,7 +1524,7 @@ static int smu_v13_0_7_od_edit_dpm_table(struct > > smu_context *smu, > > * settings. Thus we do not cache it. > > */ > > offset_of_featurectrlmask = offsetof(OverDriveTable_t, > > FeatureCtrlMask); > > - if (memcmp(od_table + offset_of_featurectrlmask, > > + if (memcmp((u8 *)od_table + offset_of_featurectrlmask, > > table_context->user_overdrive_table + > > offset_of_featurectrlmask, > > sizeof(OverDriveTableExternal_t) - > > offset_of_featurectrlmask)) { > > smu_v13_0_7_dump_od_table(smu, od_table); @@ - > > 1537,7 +1537,7 @@ static int smu_v13_0_7_od_edit_dpm_table(struct > > smu_context *smu, > > > > od_table->OverDriveTable.FeatureCtrlMask = 0; > > memcpy(table_context->user_overdrive_table + > > offset_of_featurectrlmask, > > - od_table + offset_of_featurectrlmask, > > + (u8 *)od_table + offset_of_featurectrlmask, > > sizeof(OverDriveTableExternal_t) - > > offset_of_featurectrlmask); > > > > if (!memcmp(table_context->user_overdrive_table, > > -- > > 2.39.2 > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/amd/pm: Fix memory some memory corruption @ 2023-06-06 19:27 ` Alex Deucher 0 siblings, 0 replies; 6+ messages in thread From: Alex Deucher @ 2023-06-06 19:27 UTC (permalink / raw) To: Quan, Evan Cc: Dan Carpenter, Zhang, Horatio, Pan, Xinhui, Wang, Yang(Kevin), Feng, Kenneth, Lazar, Lijo, kernel-janitors@vger.kernel.org, amd-gfx@lists.freedesktop.org, Chai, Thomas, Daniel Vetter, Deucher, Alexander, Li, Candice, David Airlie, Koenig, Christian, Zhang, Hawking Applied. Thanks! Alex On Tue, Jun 6, 2023 at 6:27 AM Quan, Evan <Evan.Quan@amd.com> wrote: > > [AMD Official Use Only - General] > > Thanks for catching this. > Reviewed-by: Evan Quan <evan.quan@amd.com> > > > -----Original Message----- > > From: Dan Carpenter <dan.carpenter@linaro.org> > > Sent: Tuesday, June 6, 2023 4:34 PM > > To: Quan, Evan <Evan.Quan@amd.com> > > Cc: Deucher, Alexander <Alexander.Deucher@amd.com>; Koenig, Christian > > <Christian.Koenig@amd.com>; Pan, Xinhui <Xinhui.Pan@amd.com>; David > > Airlie <airlied@gmail.com>; Daniel Vetter <daniel@ffwll.ch>; Lazar, Lijo > > <Lijo.Lazar@amd.com>; Zhang, Hawking <Hawking.Zhang@amd.com>; Feng, > > Kenneth <Kenneth.Feng@amd.com>; Li, Candice <Candice.Li@amd.com>; > > Chai, Thomas <YiPeng.Chai@amd.com>; Wang, Yang(Kevin) > > <KevinYang.Wang@amd.com>; Zhang, Horatio <Hongkun.Zhang@amd.com>; > > amd-gfx@lists.freedesktop.org; kernel-janitors@vger.kernel.org > > Subject: [PATCH] drm/amd/pm: Fix memory some memory corruption > > > > The "od_table" is a pointer to a large struct, but this code is doing pointer > > math as if it were pointing to bytes. It results in writing far outside the struct. > > > > Fixes: f0a0c659fb96 ("drm/amd/pm: fulfill the OD support for SMU13.0.0") > > Fixes: e3afa4f988b3 ("drm/amd/pm: fulfill the OD support for SMU13.0.7") > > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > > --- > > drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 4 ++-- > > drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 4 ++-- > > 2 files changed, 4 insertions(+), 4 deletions(-) > > > > diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > > b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > > index 5ac5ea770c1c..413e592f0ed6 100644 > > --- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > > +++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c > > @@ -1535,7 +1535,7 @@ static int smu_v13_0_0_od_edit_dpm_table(struct > > smu_context *smu, > > * settings. Thus we do not cache it. > > */ > > offset_of_featurectrlmask = offsetof(OverDriveTable_t, > > FeatureCtrlMask); > > - if (memcmp(od_table + offset_of_featurectrlmask, > > + if (memcmp((u8 *)od_table + offset_of_featurectrlmask, > > table_context->user_overdrive_table + > > offset_of_featurectrlmask, > > sizeof(OverDriveTableExternal_t) - > > offset_of_featurectrlmask)) { > > smu_v13_0_0_dump_od_table(smu, od_table); @@ - > > 1548,7 +1548,7 @@ static int smu_v13_0_0_od_edit_dpm_table(struct > > smu_context *smu, > > > > od_table->OverDriveTable.FeatureCtrlMask = 0; > > memcpy(table_context->user_overdrive_table + > > offset_of_featurectrlmask, > > - od_table + offset_of_featurectrlmask, > > + (u8 *)od_table + offset_of_featurectrlmask, > > sizeof(OverDriveTableExternal_t) - > > offset_of_featurectrlmask); > > > > if (!memcmp(table_context->user_overdrive_table, > > diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > > b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > > index 0bd086360efa..cda4e818aab7 100644 > > --- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > > +++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c > > @@ -1524,7 +1524,7 @@ static int smu_v13_0_7_od_edit_dpm_table(struct > > smu_context *smu, > > * settings. Thus we do not cache it. > > */ > > offset_of_featurectrlmask = offsetof(OverDriveTable_t, > > FeatureCtrlMask); > > - if (memcmp(od_table + offset_of_featurectrlmask, > > + if (memcmp((u8 *)od_table + offset_of_featurectrlmask, > > table_context->user_overdrive_table + > > offset_of_featurectrlmask, > > sizeof(OverDriveTableExternal_t) - > > offset_of_featurectrlmask)) { > > smu_v13_0_7_dump_od_table(smu, od_table); @@ - > > 1537,7 +1537,7 @@ static int smu_v13_0_7_od_edit_dpm_table(struct > > smu_context *smu, > > > > od_table->OverDriveTable.FeatureCtrlMask = 0; > > memcpy(table_context->user_overdrive_table + > > offset_of_featurectrlmask, > > - od_table + offset_of_featurectrlmask, > > + (u8 *)od_table + offset_of_featurectrlmask, > > sizeof(OverDriveTableExternal_t) - > > offset_of_featurectrlmask); > > > > if (!memcmp(table_context->user_overdrive_table, > > -- > > 2.39.2 > ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-06-06 19:35 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2023-06-06 8:33 [PATCH] drm/amd/pm: Fix memory some memory corruption Dan Carpenter 2023-06-06 8:33 ` Dan Carpenter 2023-06-06 10:27 ` Quan, Evan 2023-06-06 10:27 ` Quan, Evan 2023-06-06 19:27 ` Alex Deucher 2023-06-06 19:27 ` Alex Deucher
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.