[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CADnq5_MfynMAPU8c-Lq1X_dcDOdRpjW6i=m-Qo8zsZZ=dO-62w@mail.gmail.com>
Date: Thu, 27 Apr 2023 08:39:51 -0400
From: Alex Deucher <alexdeucher@...il.com>
To: whitehat002 whitehat002 <hackyzh002@...il.com>
Cc: alexander.deucher@....com, Xinhui.Pan@....com,
linux-kernel@...r.kernel.org, amd-gfx@...ts.freedesktop.org,
sumit.semwal@...aro.org, linaro-mm-sig@...ts.linaro.org,
dri-devel@...ts.freedesktop.org, daniel@...ll.ch,
airlied@...il.com, christian.koenig@....com,
linux-media@...r.kernel.org
Subject: Re: [PATCH v3 2/2] drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
As per my prior reply, it has been applied.
Thanks,
Alex
On Thu, Apr 27, 2023 at 8:39 AM whitehat002 whitehat002
<hackyzh002@...il.com> wrote:
>
> hello
> What is the current status of this patch, has it been applied?
>
>
> hackyzh002 <hackyzh002@...il.com> 于2023年4月19日周三 20:23写道:
> >
> > The type of size is unsigned int, if size is 0x40000000, there will
> > be an integer overflow, size will be zero after size *= sizeof(uint32_t),
> > will cause uninitialized memory to be referenced later.
> >
> > Signed-off-by: hackyzh002 <hackyzh002@...il.com>
> > ---
> > drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > index 08eced097..89bcacc65 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > @@ -192,7 +192,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
> > uint64_t *chunk_array_user;
> > uint64_t *chunk_array;
> > uint32_t uf_offset = 0;
> > - unsigned int size;
> > + size_t size;
> > int ret;
> > int i;
> >
> > --
> > 2.34.1
> >
Powered by blists - more mailing lists