mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-07 00:59:06 +00:00
Code Issues Releases Wiki Activity

drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1

Browse source 
The type of size is unsigned int, if size is 0x40000000, there will
be an integer overflow, size will be zero after size *= sizeof(uint32_t),
will cause uninitialized memory to be referenced later.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: hackyzh002 <hackyzh002@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
hackyzh002 2023-04-19 20:22:33 +08:00 committed by Alex Deucher
parent f828b681d0
commit 87c2213e85
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
View file

@ -195,7 +195,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
uint64_t *chunk_array_user; uint64_t *chunk_array_user;
uint64_t *chunk_array; uint64_t *chunk_array;
uint32_t uf_offset = 0; uint32_t uf_offset = 0;
unsigned int size; size_t size;
int ret; int ret;
int i; int i;