linux-kernel - [PATCH] drm/amd/pm: prevent invalid fan speed value in smu13 driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20241118124220.274-1-m.masimov@maxima.ru>
Date: Mon, 18 Nov 2024 15:42:17 +0300
From: Murad Masimov <m.masimov@...ima.ru>
To: Kenneth Feng <kenneth.feng@....com>
CC: Murad Masimov <m.masimov@...ima.ru>, Alex Deucher
	<alexander.deucher@....com>, Christian König
	<christian.koenig@....com>, Xinhui Pan <Xinhui.Pan@....com>, David Airlie
	<airlied@...il.com>, Simona Vetter <simona@...ll.ch>, Ma Jun
	<Jun.Ma2@....com>, Lijo Lazar <lijo.lazar@....com>, Yang Wang
	<kevinyang.wang@....com>, Asad Kamal <asad.kamal@....com>, Hawking Zhang
	<Hawking.Zhang@....com>, Srinivasan Shanmugam <srinivasan.shanmugam@....com>,
	Tim Huang <Tim.Huang@....com>, Tao Zhou <tao.zhou1@....com>, Mario
 Limonciello <mario.limonciello@....com>, Jesse Zhang <jesse.zhang@....com>,
	Evan Quan <quanliangl@...mail.com>, Kevin Wang <kevin1.wang@....com>,
	<amd-gfx@...ts.freedesktop.org>, <dri-devel@...ts.freedesktop.org>,
	<linux-kernel@...r.kernel.org>, <lvc-project@...uxtesting.org>
Subject: [PATCH] drm/amd/pm: prevent invalid fan speed value in smu13 driver

If user-provided fan speed is higher than max speed, ->set_fan_speed_rpm() won't
return error code, which can lead not only to problems with the hardware, but
also to a zero division in smu_v13_0_set_fan_speed_rpm, since (8 * speed), which
is used as a divisor, can evaluate to zero because of an integer overflow.

Define ->get_fan_parameters() callbacks for smu_v13_0_0 and smu_v13_0_7 in order
to have smu->fan_max_rpm variable initialized. Modify ->set_fan_speed_rpm()
callback to fail if speed is higher than smu->fan_max_rpm.

Fixes: c05d1c401572 ("drm/amd/swsmu: add aldebaran smu13 ip support (v3)")
Signed-off-by: Murad Masimov <m.masimov@...ima.ru>
---
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c       |  2 +-
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 11 +++++++++++
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 11 +++++++++++
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index e17466cc1952..6f3277639fe9 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -1228,7 +1228,7 @@ int smu_v13_0_set_fan_speed_rpm(struct smu_context *smu,
 	uint32_t tach_period;
 	int ret;

-	if (!speed)
+	if (!speed || speed > smu->fan_max_rpm)
 		return -EINVAL;

 	ret = smu_v13_0_auto_fan_control(smu, 0);
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
index d53e162dcd8d..44844cddb3bf 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
@@ -947,6 +947,16 @@ static int smu_v13_0_0_get_dpm_ultimate_freq(struct smu_context *smu,
 	return 0;
 }

+static int smu_v13_0_0_get_fan_parameters(struct smu_context *smu)
+{
+	struct smu_table_context *table_context = &smu->smu_table;
+	PPTable_t *smc_pptable = table_context->driver_pptable;
+
+	smu->fan_max_rpm = smc_pptable->SkuTable.FanMaximumRpm;
+
+	return 0;
+}
+
 static int smu_v13_0_0_read_sensor(struct smu_context *smu,
 				   enum amd_pp_sensors sensor,
 				   void *data,
@@ -3045,6 +3055,7 @@ static const struct pptable_funcs smu_v13_0_0_ppt_funcs = {
 	.get_dpm_ultimate_freq = smu_v13_0_0_get_dpm_ultimate_freq,
 	.get_vbios_bootup_values = smu_v13_0_get_vbios_bootup_values,
 	.read_sensor = smu_v13_0_0_read_sensor,
+	.get_fan_parameters = smu_v13_0_0_get_fan_parameters,
 	.feature_is_enabled = smu_cmn_feature_is_enabled,
 	.print_clk_levels = smu_v13_0_0_print_clk_levels,
 	.force_clk_levels = smu_v13_0_0_force_clk_levels,
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
index b891a5e0a396..b305bce1bccc 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
@@ -936,6 +936,16 @@ static int smu_v13_0_7_get_dpm_ultimate_freq(struct smu_context *smu,
 	return 0;
 }

+static int smu_v13_0_7_get_fan_parameters(struct smu_context *smu)
+{
+	struct smu_table_context *table_context = &smu->smu_table;
+	PPTable_t *smc_pptable = table_context->driver_pptable;
+
+	smu->fan_max_rpm = smc_pptable->SkuTable.FanMaximumRpm;
+
+	return 0;
+}
+
 static int smu_v13_0_7_read_sensor(struct smu_context *smu,
 				   enum amd_pp_sensors sensor,
 				   void *data,
@@ -2628,6 +2638,7 @@ static const struct pptable_funcs smu_v13_0_7_ppt_funcs = {
 	.get_dpm_ultimate_freq = smu_v13_0_7_get_dpm_ultimate_freq,
 	.get_vbios_bootup_values = smu_v13_0_get_vbios_bootup_values,
 	.read_sensor = smu_v13_0_7_read_sensor,
+	.get_fan_parameters = smu_v13_0_7_get_fan_parameters,
 	.feature_is_enabled = smu_cmn_feature_is_enabled,
 	.print_clk_levels = smu_v13_0_7_print_clk_levels,
 	.force_clk_levels = smu_v13_0_7_force_clk_levels,
--
2.39.2