diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2021-02-02 08:56:36 +0300 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2021-02-02 12:12:55 -0500 |
| commit | c915ef890d5dc79f483e1ca3b3a5b5f1a170690c (patch) | |
| tree | 026abda0448ad3b1cf339c1587c00f83c20c4e39 | |
| parent | 4b1d6831b379b341971b694808ad7065a22cd90a (diff) | |
drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask()
If the user passes a "level" value which is higher than 31 then that
leads to shift wrapping. The undefined behavior will lead to a
syzkaller stack dump.
Fixes: 5632708f4452 ("drm/amd/powerplay: add dpm force multiple levels on cz/tonga/fiji/polaris (v2)")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
| -rw-r--r-- | drivers/gpu/drm/amd/pm/amdgpu_pm.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c index 0d37c849b686..cf475ac01b27 100644 --- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c +++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c @@ -1095,7 +1095,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev, static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask) { int ret; - long level; + unsigned long level; char *sub_str = NULL; char *tmp; char buf_cpy[AMDGPU_MASK_BUF_MAX + 1]; @@ -1110,8 +1110,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask) tmp = buf_cpy; while ((sub_str = strsep(&tmp, delimiter)) != NULL) { if (strlen(sub_str)) { - ret = kstrtol(sub_str, 0, &level); - if (ret) + ret = kstrtoul(sub_str, 0, &level); + if (ret || level > 31) return -EINVAL; *mask |= 1 << level; } else |