* [PATCH] drm/amdgpu: fix integer overflow test in amdgpu_bo_list_create()
@ 2018-08-10 10:50 Dan Carpenter
[not found] ` <20180810105032.cltqjuv7tqfud7n6-vMlZ3nK25oGAIHFoDFOv9A@public.gmane.org>
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2018-08-10 10:50 UTC (permalink / raw)
To: Alex Deucher, Christian König
Cc: David (ChunMing) Zhou, Andrey Grodzovsky, David Airlie,
Bas Nieuwenhuizen, kernel-janitors-u79uwXL29TY76Z2rM5mHXA,
amd-gfx-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW, Cihangir Akturk,
Huang Rui, Kent Russell
We accidentally left out the size of the amdgpu_bo_list struct. It
could lead to memory corruption on 32 bit systems. You'd have to
pick the absolute maximum and set "num_entries = 59652323" then size
would wrap to 16 bytes.
Fixes: 920990cb080a ("drm/amdgpu: allocate the bo_list array after the list")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
index d472a2c8399f..b80243d3972e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
@@ -67,7 +67,8 @@ int amdgpu_bo_list_create(struct amdgpu_device *adev, struct drm_file *filp,
unsigned i;
int r;
- if (num_entries > SIZE_MAX / sizeof(struct amdgpu_bo_list_entry))
+ if (num_entries > (SIZE_MAX - sizeof(struct amdgpu_bo_list))
+ / sizeof(struct amdgpu_bo_list_entry))
return -EINVAL;
size = sizeof(struct amdgpu_bo_list);
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] drm/amdgpu: fix integer overflow test in amdgpu_bo_list_create()
[not found] ` <20180810105032.cltqjuv7tqfud7n6-vMlZ3nK25oGAIHFoDFOv9A@public.gmane.org>
@ 2018-08-10 11:12 ` Bas Nieuwenhuizen
2018-08-10 11:52 ` Huang Rui
1 sibling, 0 replies; 3+ messages in thread
From: Bas Nieuwenhuizen @ 2018-08-10 11:12 UTC (permalink / raw)
To: dan.carpenter-QHcLZuEGTsvQT0dZR+AlfA
Cc: David1.Zhou-5C7GfCeVMHo, andrey.grodzovsky-5C7GfCeVMHo,
airlied-cv59FeDIM0c, kernel-janitors-u79uwXL29TY76Z2rM5mHXA,
amd-gfx-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW,
cakturk-Re5JQEeQqe8AvxtiuMwx3w, Huang Rui,
kent.russell-5C7GfCeVMHo, alexander.deucher-5C7GfCeVMHo,
Christian König
Reviewed-by: Bas Nieuwenhuizen <basni@chromium.org>
On Fri, Aug 10, 2018 at 12:50 PM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> We accidentally left out the size of the amdgpu_bo_list struct. It
> could lead to memory corruption on 32 bit systems. You'd have to
> pick the absolute maximum and set "num_entries = 59652323" then size
> would wrap to 16 bytes.
>
> Fixes: 920990cb080a ("drm/amdgpu: allocate the bo_list array after the list")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> index d472a2c8399f..b80243d3972e 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> @@ -67,7 +67,8 @@ int amdgpu_bo_list_create(struct amdgpu_device *adev, struct drm_file *filp,
> unsigned i;
> int r;
>
> - if (num_entries > SIZE_MAX / sizeof(struct amdgpu_bo_list_entry))
> + if (num_entries > (SIZE_MAX - sizeof(struct amdgpu_bo_list))
> + / sizeof(struct amdgpu_bo_list_entry))
> return -EINVAL;
>
> size = sizeof(struct amdgpu_bo_list);
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] drm/amdgpu: fix integer overflow test in amdgpu_bo_list_create()
[not found] ` <20180810105032.cltqjuv7tqfud7n6-vMlZ3nK25oGAIHFoDFOv9A@public.gmane.org>
2018-08-10 11:12 ` Bas Nieuwenhuizen
@ 2018-08-10 11:52 ` Huang Rui
1 sibling, 0 replies; 3+ messages in thread
From: Huang Rui @ 2018-08-10 11:52 UTC (permalink / raw)
To: Dan Carpenter
Cc: Zhou, David(ChunMing), Grodzovsky, Andrey, David Airlie,
Bas Nieuwenhuizen,
kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
amd-gfx-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org,
Cihangir Akturk, Russell, Kent, Deucher, Alexander,
Koenig, Christian
On Fri, Aug 10, 2018 at 06:50:32PM +0800, Dan Carpenter wrote:
> We accidentally left out the size of the amdgpu_bo_list struct. It
> could lead to memory corruption on 32 bit systems. You'd have to
> pick the absolute maximum and set "num_entries = 59652323" then size
> would wrap to 16 bytes.
>
> Fixes: 920990cb080a ("drm/amdgpu: allocate the bo_list array after the list")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Nice catch!
Acked-by: Huang Rui <ray.huang@amd.com>
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> index d472a2c8399f..b80243d3972e 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> @@ -67,7 +67,8 @@ int amdgpu_bo_list_create(struct amdgpu_device *adev, struct drm_file *filp,
> unsigned i;
> int r;
>
> - if (num_entries > SIZE_MAX / sizeof(struct amdgpu_bo_list_entry))
> + if (num_entries > (SIZE_MAX - sizeof(struct amdgpu_bo_list))
> + / sizeof(struct amdgpu_bo_list_entry))
> return -EINVAL;
>
> size = sizeof(struct amdgpu_bo_list);
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-08-10 11:52 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-08-10 10:50 [PATCH] drm/amdgpu: fix integer overflow test in amdgpu_bo_list_create() Dan Carpenter
[not found] ` <20180810105032.cltqjuv7tqfud7n6-vMlZ3nK25oGAIHFoDFOv9A@public.gmane.org>
2018-08-10 11:12 ` Bas Nieuwenhuizen
2018-08-10 11:52 ` Huang Rui
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox