Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20230419122233.3440-1-hackyzh002@gmail.com> <CAF6NKda1Jy_wfxaVqWt-o75f1BO-o4JXHY9HS9_JtJ2FHztMmQ@mail.gmail.com>
 <CADnq5_MfynMAPU8c-Lq1X_dcDOdRpjW6i=m-Qo8zsZZ=dO-62w@mail.gmail.com>
In-Reply-To: <CADnq5_MfynMAPU8c-Lq1X_dcDOdRpjW6i=m-Qo8zsZZ=dO-62w@mail.gmail.com>
From:   whitehat002 whitehat002 <hackyzh002@gmail.com>
Date:   Fri, 28 Apr 2023 08:45:36 +0800
Message-ID: <CAF6NKdaxK_ZRkKRyWtm9Cj-8fNE9RptW3FjW-V39rmaHaCGHTw@mail.gmail.com>
Subject: Re: [PATCH v3 2/2] drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
To:     Alex Deucher <alexdeucher@gmail.com>
Cc:     alexander.deucher@amd.com, Xinhui.Pan@amd.com,
        linux-kernel@vger.kernel.org, amd-gfx@lists.freedesktop.org,
        sumit.semwal@linaro.org, linaro-mm-sig@lists.linaro.org,
        dri-devel@lists.freedesktop.org, daniel@ffwll.ch,
        airlied@gmail.com, christian.koenig@amd.com,
        linux-media@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Alex,I have a question, why I don't see it on the
https://patchwork.freedesktop.org/

Alex Deucher <alexdeucher@gmail.com> =E4=BA=8E2023=E5=B9=B44=E6=9C=8827=E6=
=97=A5=E5=91=A8=E5=9B=9B 20:40=E5=86=99=E9=81=93=EF=BC=9A
>
> As per my prior reply, it has been applied.
>
> Thanks,
>
> Alex
>
> On Thu, Apr 27, 2023 at 8:39=E2=80=AFAM whitehat002 whitehat002
> <hackyzh002@gmail.com> wrote:
> >
> > hello
> > What is the current status of this patch, has it been applied?
> >
> >
> > hackyzh002 <hackyzh002@gmail.com> =E4=BA=8E2023=E5=B9=B44=E6=9C=8819=E6=
=97=A5=E5=91=A8=E4=B8=89 20:23=E5=86=99=E9=81=93=EF=BC=9A
> > >
> > > The type of size is unsigned int, if size is 0x40000000, there will
> > > be an integer overflow, size will be zero after size *=3D sizeof(uint=
32_t),
> > > will cause uninitialized memory to be referenced later.
> > >
> > > Signed-off-by: hackyzh002 <hackyzh002@gmail.com>
> > > ---
> > >  drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm=
/amd/amdgpu/amdgpu_cs.c
> > > index 08eced097..89bcacc65 100644
> > > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> > > @@ -192,7 +192,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parse=
r *p,
> > >         uint64_t *chunk_array_user;
> > >         uint64_t *chunk_array;
> > >         uint32_t uf_offset =3D 0;
> > > -       unsigned int size;
> > > +       size_t size;
> > >         int ret;
> > >         int i;
> > >
> > > --
> > > 2.34.1
> > >