mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-20 17:41:09 +00:00
drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask()
[ Upstream commitc915ef890d
] If the user passes a "level" value which is higher than 31 then that leads to shift wrapping. The undefined behavior will lead to a syzkaller stack dump. Fixes:5632708f44
("drm/amd/powerplay: add dpm force multiple levels on cz/tonga/fiji/polaris (v2)") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
a9553ae64d
commit
c1b18119d8
1 changed files with 3 additions and 3 deletions
|
@ -1070,7 +1070,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev,
|
|||
static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
|
||||
{
|
||||
int ret;
|
||||
long level;
|
||||
unsigned long level;
|
||||
char *sub_str = NULL;
|
||||
char *tmp;
|
||||
char buf_cpy[AMDGPU_MASK_BUF_MAX + 1];
|
||||
|
@ -1086,8 +1086,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
|
|||
while (tmp[0]) {
|
||||
sub_str = strsep(&tmp, delimiter);
|
||||
if (strlen(sub_str)) {
|
||||
ret = kstrtol(sub_str, 0, &level);
|
||||
if (ret)
|
||||
ret = kstrtoul(sub_str, 0, &level);
|
||||
if (ret || level > 31)
|
||||
return -EINVAL;
|
||||
*mask |= 1 << level;
|
||||
} else
|
||||
|
|
Loading…
Reference in a new issue