kernel-janitors.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 1/4] drm/amdgpu: fix a signedness bug in __verify_ras_table_checksum()
@ 2021-07-03  9:44 Dan Carpenter
  2021-07-03  9:44 ` [PATCH 2/4] drm/amdgpu: Fix signedness bug in __amdgpu_eeprom_xfer() Dan Carpenter
                   ` (3 more replies)
  0 siblings, 4 replies; 6+ messages in thread
From: Dan Carpenter @ 2021-07-03  9:44 UTC (permalink / raw)
  To: Alex Deucher, Luben Tuikov
  Cc: Christian König, Pan, Xinhui, David Airlie, Daniel Vetter,
	Hawking Zhang, Guchun Chen, John Clements, Dennis Li, amd-gfx,
	dri-devel, kernel-janitors

If amdgpu_eeprom_read() returns a negative error code then the error
handling checks:

	if (res < buf_size) {

The problem is that "buf_size" is a u32 so negative values are type
promoted to a high positive values and the condition is false.  Fix
this by changing the type of "buf_size" to int.

Fixes: 79beb6114014 ("drm/amdgpu: Optimize EEPROM RAS table I/O")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
It's hard for me to tell the exact upper bound that "buf_size" can be,
but if it's over USHRT_MAX then we are well toasted.

 drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
index fc70620369e4..f07a456506ef 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
@@ -978,9 +978,8 @@ const struct file_operations amdgpu_ras_debugfs_eeprom_table_ops = {
 static int __verify_ras_table_checksum(struct amdgpu_ras_eeprom_control *control)
 {
 	struct amdgpu_device *adev = to_amdgpu_device(control);
-	int res;
+	int buf_size, res;
 	u8  csum, *buf, *pp;
-	u32 buf_size;
 
 	buf_size = RAS_TABLE_HEADER_SIZE +
 		control->ras_num_recs * RAS_TABLE_RECORD_SIZE;
-- 
2.30.2


^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2021-07-06  0:52 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-03  9:44 [PATCH 1/4] drm/amdgpu: fix a signedness bug in __verify_ras_table_checksum() Dan Carpenter
2021-07-03  9:44 ` [PATCH 2/4] drm/amdgpu: Fix signedness bug in __amdgpu_eeprom_xfer() Dan Carpenter
2021-07-03  9:45 ` [PATCH 3/4] drm/amdgpu: unlock on error in amdgpu_ras_debugfs_table_read() Dan Carpenter
2021-07-03  9:46 ` [PATCH 4/4] drm/amdgpu: return -EFAULT if copy_to_user() fails Dan Carpenter
2021-07-04 15:18 ` [PATCH 1/4] drm/amdgpu: fix a signedness bug in __verify_ras_table_checksum() Luben Tuikov
2021-07-06  0:52   ` Luben Tuikov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).