Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <62ae58cb-9fec-37ca-fd40-12bf0c1c5ba3@amd.com>
Date:   Wed, 19 Apr 2023 14:23:49 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.10.0
Subject: Re: [PATCH V3 1/2] drm/radeon: Fix integer overflow in
 radeon_cs_parser_init
Content-Language: en-US
To:     hackyzh002 <hackyzh002@gmail.com>, alexander.deucher@amd.com
Cc:     Xinhui.Pan@amd.com, airlied@gmail.com, daniel@ffwll.ch,
        sumit.semwal@linaro.org, amd-gfx@lists.freedesktop.org,
        dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
        linux-media@vger.kernel.org, linaro-mm-sig@lists.linaro.org
References: <20230419122058.3420-1-hackyzh002@gmail.com>
From:   =?UTF-8?Q?Christian_K=c3=b6nig?= <christian.koenig@amd.com>
In-Reply-To: <20230419122058.3420-1-hackyzh002@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?cUd1L1hrUGt4RWZuRnZDMGtQN3J4WHRqTnQ1NksyUzRpNkFJSUlWOEd1U3FQ?=
 =?utf-8?B?WFgyMWdGRWJLUUVYYUdIajFSZi9ZSTVsRFVURU5jRVlzbGhwMy9iZHFNVVg3?=
 =?utf-8?B?RVROcVpNL1pIVGRFZ2pIbWtRNmFqYnozSm5Dd09SUzMrVnRvMHdNMjV0MU85?=
 =?utf-8?B?ZXpBWmVJUnZFeUkzWFNMaEZFeVh2bXNWYlVqMVFKWlpTR1dhQ0dmU1EvWFI0?=
 =?utf-8?B?bnFHVnFIL0YwSUR3SzRPejRUR2JsWEtHT21vS2c0QlFlNDgxZmVDUlFsblg4?=
 =?utf-8?B?TEh1UEp0cDNzakNNOHdmeUFSTjkydzllVzZnYzJESGtPYThpVkZlcjR3Zy9v?=
 =?utf-8?B?SlpVWTd6cWo5SGo5emNUSE5KdnFqOTVEbDgwUFVmeUJ3QWtiZzFidDErQVpQ?=
 =?utf-8?B?MENFUTBRYS81S25hVlUrMmxldHlSLzltc2xnYXUwa2R5K1hpZVZqUjRHSFhI?=
 =?utf-8?B?cTZhd1JxZ0M5YUVkZTF4bG40TTA2R1R6bmtRQjlZYi9oTWJDbW9CUjRTdWtJ?=
 =?utf-8?B?RjBrWkxyaGN5OU9MUm9NR1h6cW5EcjJ0UlZsa09NbDM4SHd4MGREeVEyQnJi?=
 =?utf-8?B?b2IvZVhtdFZuRnVaTUkrVUZhamRoRFJVc29SazREZXFWM2UyTEVBNGFYUEZB?=
 =?utf-8?B?ZDBySWdXTUp6cjFxVmROUXQybHhyV3dDMzZNUEF3RTdPWU9PWC9QOGx4RUVQ?=
 =?utf-8?B?dWtFMWtSaVFydFVRcWNKdEVkYzN6bGN1UUxqK0o5dWdocDd6Y2I1RDZINFps?=
 =?utf-8?B?Ui91TEFqaXRCZk9DNldPQXkyNXdKSHlxZm93Zk5aMTl2UitUQURmcFU5RmlB?=
 =?utf-8?B?Uk5lbHFqcDlYMngyRG8rMXVWOGJxLytXN3pKbi9DcFRlOWhrM3M3emdkVDNj?=
 =?utf-8?B?WFRlbmRhSHROZWI3dGMrZUU1RnJlVlU1L0x6WDExcXhaNDJpNStNZTBVVDVT?=
 =?utf-8?B?T1QvRTdKSFlLUXZMOFZoRFNJQjFPZEtjQW1iTDFZTTliZ2hJZW1yYUtmU0hY?=
 =?utf-8?B?UEMwZzNMNDhmN2dlN2h0c2lkL1A3WFNjQklobzhCbHZQN0oyc3B0MnBYeWZj?=
 =?utf-8?B?QlpyVkxScXZ5MW44enBGWjRWUnppTnJiWklIN0RmUzQyNUxuMktTY28xUUVT?=
 =?utf-8?B?eGlyQ3JtMUVnU3hMQ2c0cU5HSENXZUhnTTJGTGtaRWxVRzdtbk5MRHgxYkJY?=
 =?utf-8?B?S2JQTTBoRytINzJHN2RjOUtCOHNMdjhlVFltUEZNdkI4VytCTFhpWjZXN09w?=
 =?utf-8?B?RU5kUjdyYVBYa1hPd3BPS0Zta1dsZlRpTHFldkw2M3p5ZTZmSTIxalpSSElu?=
 =?utf-8?B?NEIrOVNIVHE5c09kdU9veDJKaHpvSUZOdHVzVU8xT2hORHcvbUJRQnhzejBp?=
 =?utf-8?B?UDBPdGVuYjh5UG5KSkFVUkVjWldLdFRTZEVjNERxZ0p6UHlEc1RlWXJoRXNk?=
 =?utf-8?B?b2xIOWY5a1RQeUp6R2xOcWZ2eHRnRFpYNU83dlBvK2Y2MjF0U1lsN0t6elRX?=
 =?utf-8?B?M3pqemQvWFZzekZmREpHeFhhRXFvbDVMekwrVWZ5c0FkSXdWaHBXdmhXYTVn?=
 =?utf-8?B?M0YyZWF6UHdLdEZKSVZMNWJueE1tbEhDMTk4OWhXZFVHNUc1Rm1NcWlybHBu?=
 =?utf-8?B?OWc2VGRUL0ViRjRSZjZVOFVuNDdyRnZ3bjR1Z0pXSEh2cHF3NG9tRGw5QXhy?=
 =?utf-8?B?bkliSlBZNGx4Zkk4Mk1Jc29JMERqaFdzc3JKSHBBTHEwMkV5ai8rM0dueUdQ?=
 =?utf-8?B?eStVNjNucmZ5TWRnZEZQNkZWaUNMV2ZiZFYwNEh4N0lWMFFpWWxYUFh1bEhZ?=
 =?utf-8?B?UTB2Vm41U1hSRlNmeHU0NE1SM1dvMVErbUFIWmRZY1ZpKy9WMkpJaEs3WHFu?=
 =?utf-8?B?QzVLdnVjVzYrK2Y5Uml0WnlwUWpYd2psQm81MWJ4aEl0bThXbys3OGFlZ0pK?=
 =?utf-8?B?Y0xrTHlZeDlndWM3aUZPR2ptelhVVXd0bWdUTlh2VEloNkI3Mkh3aDJYT0VB?=
 =?utf-8?B?dGsrVU42UEVYcHRhL0t6T2hpNitEWE9NamRoc2tLQVhDL3cycUE1TGVUMjJH?=
 =?utf-8?B?bEFHZlNnbFNHZWNqdU9iYVV4UjNta1BhbnhsTFRjdGJ2amk0ZUVuaVZYSDMz?=
 =?utf-8?B?MXpyS082bjd6dVlRc1pVc0hOUWJYMTlrYTZ5M1J6ME43RTBlUGV6ZTdxc3Rm?=
 =?utf-8?Q?Ke5APOLAfZUYehj57I618+R0rn6GrvkwsGREdrEyW9xP?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: cd612fe6-04b4-4bb8-f82d-08db40d0f1c6
X-MS-Exchange-CrossTenant-AuthSource: BN8PR12MB3587.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Apr 2023 12:23:55.9863
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: JnPSZlcEs/j3ltlFDAi4Kkn3yHRiMY7GQJXahg4Cm8DRYEnCpU6cRG6lCMjsK08k
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4558
X-Spam-Status: No, score=-3.7 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,NICE_REPLY_A,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Am 19.04.23 um 14:20 schrieb hackyzh002:
> The type of size is unsigned, if size is 0x40000000, there will be an
> integer overflow, size will be zero after size *= sizeof(uint32_t),
> will cause uninitialized memory to be referenced later
>
> Signed-off-by: hackyzh002 <hackyzh002@gmail.com>

Reviewed-by: Christian König <christian.koenig@amd.com> for the series.

> ---
>   drivers/gpu/drm/radeon/radeon_cs.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
> index 46a27ebf4..a6700d727 100644
> --- a/drivers/gpu/drm/radeon/radeon_cs.c
> +++ b/drivers/gpu/drm/radeon/radeon_cs.c
> @@ -270,7 +270,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
>   {
>   	struct drm_radeon_cs *cs = data;
>   	uint64_t *chunk_array_ptr;
> -	unsigned size, i;
> +	u64 size;
> +	unsigned i;
>   	u32 ring = RADEON_CS_RING_GFX;
>   	s32 priority = 0;
>