Re: [patch v2] drm/amdgpu: missing bounds check in amdgpu_set_pp_force_state()

On Thu, Jun 16, 2016 at 4:39 AM, Christian König christian.koenig@amd.com wrote:

Am 16.06.2016 um 10:30 schrieb Dan Carpenter:

...

There is no limit on high "idx" can go. It should be less than ARRAY_SIZE(data.states) which is 16.

The "data" variable wasn't declared in that scope so I shifted the code around a bit to make it work. Also I made "idx" unsigned.

Fixes: f3898ea12fc1 ('drm/amd/powerplay: add some sysfs interfaces for powerplay.') Signed-off-by: Dan Carpenter dan.carpenter@oracle.com

Acked-by: Christian König christian.koenig@amd.com.

Applied. thanks!

Alex

...

---

v2: make idx unsigned

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c index 589b36e..0e13d80 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c @@ -270,30 +270,28 @@ static ssize_t amdgpu_set_pp_force_state(struct device *dev, struct drm_device *ddev = dev_get_drvdata(dev); struct amdgpu_device *adev = ddev->dev_private; enum amd_pm_state_type state = 0;

•   long idx;
  

•   unsigned long idx;
    int ret;
    if (strlen(buf) == 1)
            adev->pp_force_state_enabled = false;
  

•   else {
  

•           ret = kstrtol(buf, 0, &idx);
  

•   else if (adev->pp_enabled) {
  

•           struct pp_states_info data;
  

  •         if (ret) {
    

•           ret = kstrtoul(buf, 0, &idx);
  

•           if (ret || idx >= ARRAY_SIZE(data.states)) {
                    count = -EINVAL;
                    goto fail;
            }
  

  •         if (adev->pp_enabled) {
    

•                   struct pp_states_info data;
  

•                   amdgpu_dpm_get_pp_num_states(adev, &data);
  

•                   state = data.states[idx];
  

•                   /* only set user selected power states */
  

•                   if (state != POWER_STATE_TYPE_INTERNAL_BOOT &&
  

•                           state != POWER_STATE_TYPE_DEFAULT) {
  

•                           amdgpu_dpm_dispatch_task(adev,
  

AMD_PP_EVENT_ENABLE_USER_STATE, &state, NULL);

•                           adev->pp_force_state_enabled = true;
  

•                   }
  

•           amdgpu_dpm_get_pp_num_states(adev, &data);
  

•           state = data.states[idx];
  

•           /* only set user selected power states */
  

•           if (state != POWER_STATE_TYPE_INTERNAL_BOOT &&
  

•               state != POWER_STATE_TYPE_DEFAULT) {
  

•                   amdgpu_dpm_dispatch_task(adev,
  

•                                   AMD_PP_EVENT_ENABLE_USER_STATE,
  

&state, NULL);

•                   adev->pp_force_state_enabled = true;
            }
    }
  

  fail:

---

dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel