* [PATCH] drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask()
@ 2021-02-02 5:56 Dan Carpenter
2021-02-02 16:38 ` Alex Deucher
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2021-02-02 5:56 UTC (permalink / raw)
To: Alex Deucher
Cc: Xiaojian Du, David Airlie, kernel-janitors, Kevin Wang, Huang Rui,
amd-gfx, Nirmoy Das, Daniel Vetter, Eric Huang, Evan Quan,
Christian König
If the user passes a "level" value which is higher than 31 then that
leads to shift wrapping. The undefined behavior will lead to a
syzkaller stack dump.
Fixes: 5632708f4452 ("drm/amd/powerplay: add dpm force multiple levels on cz/tonga/fiji/polaris (v2)")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/gpu/drm/amd/pm/amdgpu_pm.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
index e9b569b76716..1a4010fcf561 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
@@ -1094,7 +1094,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev,
static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
{
int ret;
- long level;
+ unsigned long level;
char *sub_str = NULL;
char *tmp;
char buf_cpy[AMDGPU_MASK_BUF_MAX + 1];
@@ -1109,9 +1109,9 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
tmp = buf_cpy;
while (tmp[0]) {
sub_str = strsep(&tmp, delimiter);
- if (strlen(sub_str)) {
- ret = kstrtol(sub_str, 0, &level);
- if (ret)
+ if (sub_str[0]) {
+ ret = kstrtoul(sub_str, 0, &level);
+ if (ret || level > 31)
return -EINVAL;
*mask |= 1 << level;
} else
--
2.29.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask()
2021-02-02 5:56 [PATCH] drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask() Dan Carpenter
@ 2021-02-02 16:38 ` Alex Deucher
0 siblings, 0 replies; 2+ messages in thread
From: Alex Deucher @ 2021-02-02 16:38 UTC (permalink / raw)
To: Dan Carpenter
Cc: Xiaojian Du, David Airlie, Kevin Wang, kernel-janitors,
Nirmoy Das, amd-gfx list, Eric Huang, Huang Rui, Daniel Vetter,
Alex Deucher, Evan Quan, Christian König
On Tue, Feb 2, 2021 at 12:57 AM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> If the user passes a "level" value which is higher than 31 then that
> leads to shift wrapping. The undefined behavior will lead to a
> syzkaller stack dump.
>
> Fixes: 5632708f4452 ("drm/amd/powerplay: add dpm force multiple levels on cz/tonga/fiji/polaris (v2)")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied. Thanks!
Alex
> ---
> drivers/gpu/drm/amd/pm/amdgpu_pm.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
> index e9b569b76716..1a4010fcf561 100644
> --- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
> +++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
> @@ -1094,7 +1094,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev,
> static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
> {
> int ret;
> - long level;
> + unsigned long level;
> char *sub_str = NULL;
> char *tmp;
> char buf_cpy[AMDGPU_MASK_BUF_MAX + 1];
> @@ -1109,9 +1109,9 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
> tmp = buf_cpy;
> while (tmp[0]) {
> sub_str = strsep(&tmp, delimiter);
> - if (strlen(sub_str)) {
> - ret = kstrtol(sub_str, 0, &level);
> - if (ret)
> + if (sub_str[0]) {
> + ret = kstrtoul(sub_str, 0, &level);
> + if (ret || level > 31)
> return -EINVAL;
> *mask |= 1 << level;
> } else
> --
> 2.29.2
>
> _______________________________________________
> amd-gfx mailing list
> amd-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/amd-gfx
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-02-02 16:38 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-02-02 5:56 [PATCH] drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask() Dan Carpenter
2021-02-02 16:38 ` Alex Deucher
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox