2020-09-12 10:30:33

by Zhenzhong Duan

Subject: [PATCH] drm/msm/a6xx: fix a potential overflow issue

It's allocating an array of a6xx_gpu_state_obj structure rathor than
its pointers.

This patch fix it.

Signed-off-by: Zhenzhong Duan <[email protected]>
---
drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
index b12f5b4..e9ede19 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
@@ -875,7 +875,7 @@ static void a6xx_get_indexed_registers(struct msm_gpu *gpu,
int i;

a6xx_state->indexed_regs = state_kcalloc(a6xx_state, count,
- sizeof(a6xx_state->indexed_regs));
+ sizeof(*a6xx_state->indexed_regs));
if (!a6xx_state->indexed_regs)
return;

--
1.8.3.1

2020-09-14 16:25:18

by Jordan Crouse

Subject: Re: [PATCH] drm/msm/a6xx: fix a potential overflow issue

On Sat, Sep 12, 2020 at 06:25:58PM +0800, Zhenzhong Duan wrote:
> It's allocating an array of a6xx_gpu_state_obj structure rathor than
> its pointers.
>
> This patch fix it.
>
> Signed-off-by: Zhenzhong Duan <[email protected]>

LGTM but should have a Fixes: tag for the stable trees

Fixes: d6852b4b2d01 ("drm/msm/a6xx: Track and manage a6xx state memory")
Reviewed-by: Jordan Crouse <[email protected]>

> ---
> drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
> index b12f5b4..e9ede19 100644
> --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
> +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
> @@ -875,7 +875,7 @@ static void a6xx_get_indexed_registers(struct msm_gpu *gpu,
> int i;
>
> a6xx_state->indexed_regs = state_kcalloc(a6xx_state, count,
> - sizeof(a6xx_state->indexed_regs));
> + sizeof(*a6xx_state->indexed_regs));
> if (!a6xx_state->indexed_regs)
> return;
>
> --
> 1.8.3.1
>

--
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project

2020-09-15 00:36:16

by Bjorn Andersson

Subject: Re: [PATCH] drm/msm/a6xx: fix a potential overflow issue

On Sat 12 Sep 10:25 UTC 2020, Zhenzhong Duan wrote:

> It's allocating an array of a6xx_gpu_state_obj structure rathor than
> its pointers.
>
> This patch fix it.
>

Reviewed-by: Bjorn Andersson <[email protected]>

> Signed-off-by: Zhenzhong Duan <[email protected]>
> ---
> drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
> index b12f5b4..e9ede19 100644
> --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
> +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
> @@ -875,7 +875,7 @@ static void a6xx_get_indexed_registers(struct msm_gpu *gpu,
> int i;
>
> a6xx_state->indexed_regs = state_kcalloc(a6xx_state, count,
> - sizeof(a6xx_state->indexed_regs));
> + sizeof(*a6xx_state->indexed_regs));
> if (!a6xx_state->indexed_regs)
> return;
>
> --
> 1.8.3.1
>

2020-09-16 02:33:03

by Zhenzhong Duan

Subject: Re: [PATCH] drm/msm/a6xx: fix a potential overflow issue

On Tue, Sep 15, 2020 at 12:20 AM Jordan Crouse <[email protected]> wrote:
>
> On Sat, Sep 12, 2020 at 06:25:58PM +0800, Zhenzhong Duan wrote:
> > It's allocating an array of a6xx_gpu_state_obj structure rathor than
> > its pointers.
> >
> > This patch fix it.
> >
> > Signed-off-by: Zhenzhong Duan <[email protected]>
>
> LGTM but should have a Fixes: tag for the stable trees
>
> Fixes: d6852b4b2d01 ("drm/msm/a6xx: Track and manage a6xx state memory")
> Reviewed-by: Jordan Crouse <[email protected]>

I had sent a v2 version with same change as you suggested on Sep 14,
could you help review it? Thanks
https://lkml.org/lkml/2020/9/13/311