Skip to content

Commit c915ef8

Browse files
Dan Carpenteralexdeucher
authored andcommitted
drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask()
If the user passes a "level" value which is higher than 31 then that leads to shift wrapping. The undefined behavior will lead to a syzkaller stack dump. Fixes: 5632708 ("drm/amd/powerplay: add dpm force multiple levels on cz/tonga/fiji/polaris (v2)") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
1 parent 4b1d683 commit c915ef8

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

drivers/gpu/drm/amd/pm/amdgpu_pm.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1095,7 +1095,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev,
10951095
static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
10961096
{
10971097
int ret;
1098-
long level;
1098+
unsigned long level;
10991099
char *sub_str = NULL;
11001100
char *tmp;
11011101
char buf_cpy[AMDGPU_MASK_BUF_MAX + 1];
@@ -1110,8 +1110,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
11101110
tmp = buf_cpy;
11111111
while ((sub_str = strsep(&tmp, delimiter)) != NULL) {
11121112
if (strlen(sub_str)) {
1113-
ret = kstrtol(sub_str, 0, &level);
1114-
if (ret)
1113+
ret = kstrtoul(sub_str, 0, &level);
1114+
if (ret || level > 31)
11151115
return -EINVAL;
11161116
*mask |= 1 << level;
11171117
} else

0 commit comments

Comments
 (0)