diff options
| author | hackyzh002 <hackyzh002@gmail.com> | 2023-04-19 20:20:58 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-07-27 08:46:57 +0200 |
| commit | c0d7dbc6b7a61a56028118c00af2c8319d44a682 (patch) | |
| tree | a8ec3689a0cc163d0957e24ba35e3e86d35c7693 /drivers/gpu/drm/radeon | |
| parent | bca9fb7a5a86a33d3922a46552063070fcbe515b (diff) | |
drm/radeon: Fix integer overflow in radeon_cs_parser_init
[ Upstream commit f828b681d0cd566f86351c0b913e6cb6ed8c7b9c ]
The type of size is unsigned, if size is 0x40000000, there will be an
integer overflow, size will be zero after size *= sizeof(uint32_t),
will cause uninitialized memory to be referenced later
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: hackyzh002 <hackyzh002@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/gpu/drm/radeon')
| -rw-r--r-- | drivers/gpu/drm/radeon/radeon_cs.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c index 9ed2b2700e0a..e5fbe851ed93 100644 --- a/drivers/gpu/drm/radeon/radeon_cs.c +++ b/drivers/gpu/drm/radeon/radeon_cs.c @@ -270,7 +270,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) { struct drm_radeon_cs *cs = data; uint64_t *chunk_array_ptr; - unsigned size, i; + u64 size; + unsigned i; u32 ring = RADEON_CS_RING_GFX; s32 priority = 0; |