diff options
| author | hackyzh002 <hackyzh002@gmail.com> | 2023-04-19 15:22:33 +0300 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2023-04-21 15:50:21 +0300 |
| commit | 87c2213e85bd81e4a9a4d0880c256568794ae388 (patch) | |
| tree | 20b3d8c95aca9c9b18235301b7fc16123e0fe597 /drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | |
| parent | f828b681d0cd566f86351c0b913e6cb6ed8c7b9c (diff) | |
| download | linux-87c2213e85bd81e4a9a4d0880c256568794ae388.tar.xz | |
drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
The type of size is unsigned int, if size is 0x40000000, there will
be an integer overflow, size will be zero after size *= sizeof(uint32_t),
will cause uninitialized memory to be referenced later.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: hackyzh002 <hackyzh002@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index d8b3c9198d33..a8ec5ff41fc0 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -195,7 +195,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, uint64_t *chunk_array_user; uint64_t *chunk_array; uint32_t uf_offset = 0; - unsigned int size; + size_t size; int ret; int i; |