From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jesse Zhang <jesse.zhang@amd.com>,
Philip Yang <Philip.Yang@amd.com>,
Yifan Zhang <yifan1.zhang@amd.com>,
Alex Deucher <alexander.deucher@amd.com>,
Sasha Levin <sashal@kernel.org>,
Felix.Kuehling@amd.com, christian.koenig@amd.com,
Xinhui.Pan@amd.com, airlied@gmail.com, daniel@ffwll.ch,
amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org
Subject: [PATCH AUTOSEL 5.15 17/20] drm/amdkfd: Fix shift out-of-bounds issue
Date: Tue, 7 Nov 2023 07:29:11 -0500 [thread overview]
Message-ID: <20231107122940.3762228-17-sashal@kernel.org> (raw)
In-Reply-To: <20231107122940.3762228-1-sashal@kernel.org>
From: Jesse Zhang <jesse.zhang@amd.com>
[ Upstream commit 282c1d793076c2edac6c3db51b7e8ed2b41d60a5 ]
[ 567.613292] shift exponent 255 is too large for 64-bit type 'long unsigned int'
[ 567.614498] CPU: 5 PID: 238 Comm: kworker/5:1 Tainted: G OE 6.2.0-34-generic #34~22.04.1-Ubuntu
[ 567.614502] Hardware name: AMD Splinter/Splinter-RPL, BIOS WS43927N_871 09/25/2023
[ 567.614504] Workqueue: events send_exception_work_handler [amdgpu]
[ 567.614748] Call Trace:
[ 567.614750] <TASK>
[ 567.614753] dump_stack_lvl+0x48/0x70
[ 567.614761] dump_stack+0x10/0x20
[ 567.614763] __ubsan_handle_shift_out_of_bounds+0x156/0x310
[ 567.614769] ? srso_alias_return_thunk+0x5/0x7f
[ 567.614773] ? update_sd_lb_stats.constprop.0+0xf2/0x3c0
[ 567.614780] svm_range_split_by_granularity.cold+0x2b/0x34 [amdgpu]
[ 567.615047] ? srso_alias_return_thunk+0x5/0x7f
[ 567.615052] svm_migrate_to_ram+0x185/0x4d0 [amdgpu]
[ 567.615286] do_swap_page+0x7b6/0xa30
[ 567.615291] ? srso_alias_return_thunk+0x5/0x7f
[ 567.615294] ? __free_pages+0x119/0x130
[ 567.615299] handle_pte_fault+0x227/0x280
[ 567.615303] __handle_mm_fault+0x3c0/0x720
[ 567.615311] handle_mm_fault+0x119/0x330
[ 567.615314] ? lock_mm_and_find_vma+0x44/0x250
[ 567.615318] do_user_addr_fault+0x1a9/0x640
[ 567.615323] exc_page_fault+0x81/0x1b0
[ 567.615328] asm_exc_page_fault+0x27/0x30
[ 567.615332] RIP: 0010:__get_user_8+0x1c/0x30
Signed-off-by: Jesse Zhang <jesse.zhang@amd.com>
Suggested-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index b7d32a5062b6c..53e413d9a3030 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -698,7 +698,7 @@ svm_range_apply_attrs(struct kfd_process *p, struct svm_range *prange,
prange->flags &= ~attrs[i].value;
break;
case KFD_IOCTL_SVM_ATTR_GRANULARITY:
- prange->granularity = attrs[i].value;
+ prange->granularity = min_t(uint32_t, attrs[i].value, 0x3F);
break;
default:
WARN_ONCE(1, "svm_range_check_attrs wasn't called?");
--
2.42.0
next prev parent reply other threads:[~2023-11-07 12:44 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-07 12:28 [PATCH AUTOSEL 5.15 01/20] drm/komeda: drop all currently held locks if deadlock happens Sasha Levin
2023-11-07 12:28 ` [PATCH AUTOSEL 5.15 02/20] drm/amdkfd: Fix a race condition of vram buffer unref in svm code Sasha Levin
2023-11-07 12:28 ` [PATCH AUTOSEL 5.15 03/20] drm/amd/display: use full update for clip size increase of large plane source Sasha Levin
2023-11-07 12:28 ` [PATCH AUTOSEL 5.15 04/20] string.h: add array-wrappers for (v)memdup_user() Sasha Levin
2023-11-07 12:28 ` [PATCH AUTOSEL 5.15 05/20] kernel: kexec: copy user-array safely Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 06/20] kernel: watch_queue: " Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 07/20] drm: vmwgfx_surface.c: " Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 08/20] drm/msm/dp: skip validity check for DP CTS EDID checksum Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 09/20] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 10/20] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430 Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 11/20] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 12/20] drm/amdgpu: Fix potential null pointer derefernce Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 13/20] drm/panel: fix a possible null pointer dereference Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 14/20] drm/panel/panel-tpo-tpg110: " Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 15/20] drm/amdgpu/vkms: " Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 16/20] drm/panel: st7703: Pick different reset sequence Sasha Levin
2023-11-07 12:29 ` Sasha Levin [this message]
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 18/20] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 19/20] arm64: dts: ls208xa: use a pseudo-bus to constrain usb dma size Sasha Levin
2023-11-07 12:29 ` [PATCH AUTOSEL 5.15 20/20] selftests/efivarfs: create-read: fix a resource leak Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231107122940.3762228-17-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=Felix.Kuehling@amd.com \
--cc=Philip.Yang@amd.com \
--cc=Xinhui.Pan@amd.com \
--cc=airlied@gmail.com \
--cc=alexander.deucher@amd.com \
--cc=amd-gfx@lists.freedesktop.org \
--cc=christian.koenig@amd.com \
--cc=daniel@ffwll.ch \
--cc=dri-devel@lists.freedesktop.org \
--cc=jesse.zhang@amd.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yifan1.zhang@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox