Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755311AbdC2JYN (ORCPT ); Wed, 29 Mar 2017 05:24:13 -0400 Received: from smtp2.unicon-software.com ([213.144.0.238]:47756 "EHLO smtp2.unicon-software.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755116AbdC2JYL (ORCPT ); Wed, 29 Mar 2017 05:24:11 -0400 X-CTCH-RefID: str=0001.0A0C0201.58DB7BF2.014D,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0 From: Jan Burgmeier To: amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: airlied@linux.ie Subject: [PATCH] Fix IB va_start+ib_bytes range check on 32Bit systems Date: Wed, 29 Mar 2017 11:18:39 +0200 Message-Id: <20170329091839.5246-2-jan.burgmeier@unicon-software.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170329091839.5246-1-jan.burgmeier@unicon-software.com> References: <20170329091839.5246-1-jan.burgmeier@unicon-software.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1017 Lines: 30 Signed-off-by: Jan Burgmeier --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index 99424cb8020b..583d22974e14 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -908,6 +908,7 @@ static int amdgpu_cs_ib_fill(struct amdgpu_device *adev, struct amdgpu_bo *aobj = NULL; uint64_t offset; uint8_t *kptr; + uint64_t it_last; m = amdgpu_cs_find_mapping(parser, chunk_ib->va_start, &aobj); @@ -916,8 +917,9 @@ static int amdgpu_cs_ib_fill(struct amdgpu_device *adev, return -EINVAL; } + it_last = m->it.last; if ((chunk_ib->va_start + chunk_ib->ib_bytes) > - (m->it.last + 1) * AMDGPU_GPU_PAGE_SIZE) { + (it_last + 1) * AMDGPU_GPU_PAGE_SIZE) { DRM_ERROR("IB va_start+ib_bytes is invalid\n"); return -EINVAL; } -- 2.11.0