提交 c915ef89 编写于 作者: D Dan Carpenter 提交者: Alex Deucher

drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask()

If the user passes a "level" value which is higher than 31 then that
leads to shift wrapping.  The undefined behavior will lead to a
syzkaller stack dump.

Fixes: 5632708f ("drm/amd/powerplay: add dpm force multiple levels on cz/tonga/fiji/polaris (v2)")
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
上级 4b1d6831
......@@ -1095,7 +1095,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev,
static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
{
int ret;
long level;
unsigned long level;
char *sub_str = NULL;
char *tmp;
char buf_cpy[AMDGPU_MASK_BUF_MAX + 1];
......@@ -1110,8 +1110,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
tmp = buf_cpy;
while ((sub_str = strsep(&tmp, delimiter)) != NULL) {
if (strlen(sub_str)) {
ret = kstrtol(sub_str, 0, &level);
if (ret)
ret = kstrtoul(sub_str, 0, &level);
if (ret || level > 31)
return -EINVAL;
*mask |= 1 << level;
} else
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册