tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/amdgpu: Add bounds checking to ib_{get,set}_value

The uvd/vce/vcn code accesses the IB at predefined offsets without
checking that the IB is large enough. Check the bounds here. The caller
is responsible for making sure it can handle arbitrary return values.

Also make the idx a uint32_t to prevent overflows causing the condition
to fail.

Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

authored by

Benjamin Cheng and committed by
Alex Deucher 66085e20 4e819742

+7 -4
+7 -4
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
··· 559 559 560 560 int amdgpu_ring_init_mqd(struct amdgpu_ring *ring); 561 561 562 - static inline u32 amdgpu_ib_get_value(struct amdgpu_ib *ib, int idx) 562 + static inline u32 amdgpu_ib_get_value(struct amdgpu_ib *ib, uint32_t idx) 563 563 { 564 - return ib->ptr[idx]; 564 + if (idx < ib->length_dw) 565 + return ib->ptr[idx]; 566 + return 0; 565 567 } 566 568 567 - static inline void amdgpu_ib_set_value(struct amdgpu_ib *ib, int idx, 569 + static inline void amdgpu_ib_set_value(struct amdgpu_ib *ib, uint32_t idx, 568 570 uint32_t value) 569 571 { 570 - ib->ptr[idx] = value; 572 + if (idx < ib->length_dw) 573 + ib->ptr[idx] = value; 571 574 } 572 575 573 576 int amdgpu_ib_get(struct amdgpu_device *adev, struct amdgpu_vm *vm,