* [PATCH] drm/amdgpu: Fix integer overflow in amdgpu_gem_add_input_fence()
@ 2025-05-23 16:09 Dan Carpenter
2025-05-30 21:08 ` Alex Deucher
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2025-05-23 16:09 UTC (permalink / raw)
To: Arvind Yadav
Cc: Alex Deucher, Christian König, David Airlie, Simona Vetter,
Arvind Yadav, Shashank Sharma, Arunpravin Paneer Selvam,
Yunxiang Li, Frank Min, Kent Russell, amd-gfx, dri-devel,
linux-kernel, kernel-janitors
The "num_syncobj_handles" is a u32 value that comes from the user via the
ioctl. On 32bit systems the "sizeof(uint32_t) * num_syncobj_handles"
multiplication can have an integer overflow. Use size_mul() to fix that.
Fixes: 38c67ec9aa4b ("drm/amdgpu: Add input fence to sync bo map/unmap")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 2c68118fe9fd..0ecc88df7208 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -58,7 +58,7 @@ amdgpu_gem_add_input_fence(struct drm_file *filp,
return 0;
syncobj_handles = memdup_user(u64_to_user_ptr(syncobj_handles_array),
- sizeof(uint32_t) * num_syncobj_handles);
+ size_mul(sizeof(uint32_t), num_syncobj_handles));
if (IS_ERR(syncobj_handles))
return PTR_ERR(syncobj_handles);
--
2.47.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] drm/amdgpu: Fix integer overflow in amdgpu_gem_add_input_fence()
2025-05-23 16:09 [PATCH] drm/amdgpu: Fix integer overflow in amdgpu_gem_add_input_fence() Dan Carpenter
@ 2025-05-30 21:08 ` Alex Deucher
0 siblings, 0 replies; 2+ messages in thread
From: Alex Deucher @ 2025-05-30 21:08 UTC (permalink / raw)
To: Dan Carpenter
Cc: Arvind Yadav, Alex Deucher, Christian König, David Airlie,
Simona Vetter, Shashank Sharma, Arunpravin Paneer Selvam,
Yunxiang Li, Frank Min, Kent Russell, amd-gfx, dri-devel,
linux-kernel, kernel-janitors
Applied. Thanks!
Alex
On Fri, May 23, 2025 at 12:34 PM Dan Carpenter <dan.carpenter@linaro.org> wrote:
>
> The "num_syncobj_handles" is a u32 value that comes from the user via the
> ioctl. On 32bit systems the "sizeof(uint32_t) * num_syncobj_handles"
> multiplication can have an integer overflow. Use size_mul() to fix that.
>
> Fixes: 38c67ec9aa4b ("drm/amdgpu: Add input fence to sync bo map/unmap")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> index 2c68118fe9fd..0ecc88df7208 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> @@ -58,7 +58,7 @@ amdgpu_gem_add_input_fence(struct drm_file *filp,
> return 0;
>
> syncobj_handles = memdup_user(u64_to_user_ptr(syncobj_handles_array),
> - sizeof(uint32_t) * num_syncobj_handles);
> + size_mul(sizeof(uint32_t), num_syncobj_handles));
> if (IS_ERR(syncobj_handles))
> return PTR_ERR(syncobj_handles);
>
> --
> 2.47.2
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-05-30 21:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-05-23 16:09 [PATCH] drm/amdgpu: Fix integer overflow in amdgpu_gem_add_input_fence() Dan Carpenter
2025-05-30 21:08 ` Alex Deucher
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.