linux-kernel - Re: [PATCH] drm/amd/amdkfd: Fix large framesize for kfd_smi_ev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1c09eb78-f2a4-3f20-1bee-2590c35b982e@amd.com>
Date:   Wed, 20 May 2020 15:19:40 -0400
From:   Felix Kuehling <felix.kuehling@....com>
To:     Aurabindo Pillai <aurabindo.pillai@....com>,
        alexander.deucher@....com, christian.koenig@....com
Cc:     airlied@...ux.ie, daniel@...ll.ch, amd-gfx@...ts.freedesktop.org,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
        Amber Lin <Amber.Lin@....com>
Subject: Re: [PATCH] drm/amd/amdkfd: Fix large framesize for kfd_smi_ev_read()

Am 2020-05-20 um 9:53 a.m. schrieb Aurabindo Pillai:
> The buffer allocated is of 1024 bytes. Allocate this from
> heap instead of stack.
>
> Also remove check for stack size since we're allocating from heap
>
> Signed-off-by: Aurabindo Pillai <aurabindo.pillai@....com>
> Tested-by: Amber Lin <Amber.Lin@....com>

See one comment inline. With that fixed, the patch is

Reviewed-by: Felix Kuehling <Felix.Kuehling@....com>


> ---
>  drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 26 +++++++++++++++------
>  1 file changed, 19 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c
> index f5fd18eacf0d..5aebe169f8c6 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c
> @@ -77,9 +77,11 @@ static ssize_t kfd_smi_ev_read(struct file *filep, char __user *user,
>  	int ret;
>  	size_t to_copy;
>  	struct kfd_smi_client *client = filep->private_data;
> -	unsigned char buf[MAX_KFIFO_SIZE];
> +	unsigned char *buf;
>  
> -	BUILD_BUG_ON(MAX_KFIFO_SIZE > 1024);
> +	buf = kzalloc(MAX_KFIFO_SIZE * sizeof(*buf), GFP_KERNEL);

kzalloc is not necessary here, you could use kmalloc. The part of that
allocation that matters will be overwritten by kfifo_out.

Regards,
  Felix


> +	if (!buf)
> +		return -ENOMEM;
>  
>  	/* kfifo_to_user can sleep so we can't use spinlock protection around
>  	 * it. Instead, we kfifo out as spinlocked then copy them to the user.
> @@ -88,19 +90,29 @@ static ssize_t kfd_smi_ev_read(struct file *filep, char __user *user,
>  	to_copy = kfifo_len(&client->fifo);
>  	if (!to_copy) {
>  		spin_unlock(&client->lock);
> -		return -EAGAIN;
> +		ret = -EAGAIN;
> +		goto ret_err;
>  	}
>  	to_copy = min3(size, sizeof(buf), to_copy);
>  	ret = kfifo_out(&client->fifo, buf, to_copy);
>  	spin_unlock(&client->lock);
> -	if (ret <= 0)
> -		return -EAGAIN;
> +	if (ret <= 0) {
> +		ret = -EAGAIN;
> +		goto ret_err;
> +	}
>  
>  	ret = copy_to_user(user, buf, to_copy);
> -	if (ret)
> -		return -EFAULT;
> +	if (ret) {
> +		ret = -EFAULT;
> +		goto ret_err;
> +	}
>  
> +	kfree(buf);
>  	return to_copy;
> +
> +ret_err:
> +	kfree(buf);
> +	return ret;
>  }
>  
>  static ssize_t kfd_smi_ev_write(struct file *filep, const char __user *user,