tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/amd/pm: Fix memory some memory corruption

The "od_table" is a pointer to a large struct, but this code is doing
pointer math as if it were pointing to bytes. It results in writing
far outside the struct.

Fixes: 2e8452ea4ef6 ("drm/amd/pm: fulfill the OD support for SMU13.0.0")
Fixes: 2a9aa52e4617 ("drm/amd/pm: fulfill the OD support for SMU13.0.7")
Reviewed-by: Evan Quan <evan.quan@amd.com>
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

authored by

Dan Carpenter and committed by
Alex Deucher b7588507 d155cfff

+4 -4
+2 -2
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
··· 1535 1535 * settings. Thus we do not cache it. 1536 1536 */ 1537 1537 offset_of_featurectrlmask = offsetof(OverDriveTable_t, FeatureCtrlMask); 1538 - if (memcmp(od_table + offset_of_featurectrlmask, 1538 + if (memcmp((u8 *)od_table + offset_of_featurectrlmask, 1539 1539 table_context->user_overdrive_table + offset_of_featurectrlmask, 1540 1540 sizeof(OverDriveTableExternal_t) - offset_of_featurectrlmask)) { 1541 1541 smu_v13_0_0_dump_od_table(smu, od_table); ··· 1548 1548 1549 1549 od_table->OverDriveTable.FeatureCtrlMask = 0; 1550 1550 memcpy(table_context->user_overdrive_table + offset_of_featurectrlmask, 1551 - od_table + offset_of_featurectrlmask, 1551 + (u8 *)od_table + offset_of_featurectrlmask, 1552 1552 sizeof(OverDriveTableExternal_t) - offset_of_featurectrlmask); 1553 1553 1554 1554 if (!memcmp(table_context->user_overdrive_table,
+2 -2
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
··· 1524 1524 * settings. Thus we do not cache it. 1525 1525 */ 1526 1526 offset_of_featurectrlmask = offsetof(OverDriveTable_t, FeatureCtrlMask); 1527 - if (memcmp(od_table + offset_of_featurectrlmask, 1527 + if (memcmp((u8 *)od_table + offset_of_featurectrlmask, 1528 1528 table_context->user_overdrive_table + offset_of_featurectrlmask, 1529 1529 sizeof(OverDriveTableExternal_t) - offset_of_featurectrlmask)) { 1530 1530 smu_v13_0_7_dump_od_table(smu, od_table); ··· 1537 1537 1538 1538 od_table->OverDriveTable.FeatureCtrlMask = 0; 1539 1539 memcpy(table_context->user_overdrive_table + offset_of_featurectrlmask, 1540 - od_table + offset_of_featurectrlmask, 1540 + (u8 *)od_table + offset_of_featurectrlmask, 1541 1541 sizeof(OverDriveTableExternal_t) - offset_of_featurectrlmask); 1542 1542 1543 1543 if (!memcmp(table_context->user_overdrive_table,