From: Luben Tuikov <luben.tuikov@amd.com>
To: Dan Carpenter <dan.carpenter@oracle.com>,
Alex Deucher <alexander.deucher@amd.com>
Cc: "Christian König" <christian.koenig@amd.com>,
"Pan, Xinhui" <Xinhui.Pan@amd.com>,
"David Airlie" <airlied@linux.ie>,
"Daniel Vetter" <daniel@ffwll.ch>,
"Hawking Zhang" <Hawking.Zhang@amd.com>,
"Guchun Chen" <guchun.chen@amd.com>,
"John Clements" <john.clements@amd.com>,
"Dennis Li" <Dennis.Li@amd.com>,
amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org,
kernel-janitors@vger.kernel.org
Subject: Re: [PATCH 1/4] drm/amdgpu: fix a signedness bug in __verify_ras_table_checksum()
Date: Mon, 5 Jul 2021 20:52:11 -0400 [thread overview]
Message-ID: <c60af259-f8ab-f495-ebc3-6b58af91c708@amd.com> (raw)
In-Reply-To: <bb78075f-2249-8311-2f75-c0dfaa333ec4@amd.com>
Alex,
I think we should pull these through amd-staging-drm-next.
Regards,
Luben
On 2021-07-04 11:18 a.m., Luben Tuikov wrote:
> Series is,
> Reviewed-by: Luben Tuikov <luben.tuikov@amd.com>
>
> Regards,
> Luben
>
> On 2021-07-03 5:44 a.m., Dan Carpenter wrote:
>> If amdgpu_eeprom_read() returns a negative error code then the error
>> handling checks:
>>
>> if (res < buf_size) {
>>
>> The problem is that "buf_size" is a u32 so negative values are type
>> promoted to a high positive values and the condition is false. Fix
>> this by changing the type of "buf_size" to int.
>>
>> Fixes: 79beb6114014 ("drm/amdgpu: Optimize EEPROM RAS table I/O")
>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>> ---
>> It's hard for me to tell the exact upper bound that "buf_size" can be,
>> but if it's over USHRT_MAX then we are well toasted.
>>
>> drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 3 +--
>> 1 file changed, 1 insertion(+), 2 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
>> index fc70620369e4..f07a456506ef 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
>> @@ -978,9 +978,8 @@ const struct file_operations amdgpu_ras_debugfs_eeprom_table_ops = {
>> static int __verify_ras_table_checksum(struct amdgpu_ras_eeprom_control *control)
>> {
>> struct amdgpu_device *adev = to_amdgpu_device(control);
>> - int res;
>> + int buf_size, res;
>> u8 csum, *buf, *pp;
>> - u32 buf_size;
>>
>> buf_size = RAS_TABLE_HEADER_SIZE +
>> control->ras_num_recs * RAS_TABLE_RECORD_SIZE;
prev parent reply other threads:[~2021-07-06 0:52 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-03 9:44 [PATCH 1/4] drm/amdgpu: fix a signedness bug in __verify_ras_table_checksum() Dan Carpenter
2021-07-03 9:44 ` [PATCH 2/4] drm/amdgpu: Fix signedness bug in __amdgpu_eeprom_xfer() Dan Carpenter
2021-07-03 9:45 ` [PATCH 3/4] drm/amdgpu: unlock on error in amdgpu_ras_debugfs_table_read() Dan Carpenter
2021-07-03 9:46 ` [PATCH 4/4] drm/amdgpu: return -EFAULT if copy_to_user() fails Dan Carpenter
2021-07-04 15:18 ` [PATCH 1/4] drm/amdgpu: fix a signedness bug in __verify_ras_table_checksum() Luben Tuikov
2021-07-06 0:52 ` Luben Tuikov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c60af259-f8ab-f495-ebc3-6b58af91c708@amd.com \
--to=luben.tuikov@amd.com \
--cc=Dennis.Li@amd.com \
--cc=Hawking.Zhang@amd.com \
--cc=Xinhui.Pan@amd.com \
--cc=airlied@linux.ie \
--cc=alexander.deucher@amd.com \
--cc=amd-gfx@lists.freedesktop.org \
--cc=christian.koenig@amd.com \
--cc=dan.carpenter@oracle.com \
--cc=daniel@ffwll.ch \
--cc=dri-devel@lists.freedesktop.org \
--cc=guchun.chen@amd.com \
--cc=john.clements@amd.com \
--cc=kernel-janitors@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).