This error path needs to unlock before returning. While we're at it, the correct error code from copy_to_user() failure is -EFAULT, not -EINVAL.

Fixes: 9b790694a031 (""drm/amdgpu: RAS EEPROM table is now in debugfs) Signed-off-by: Dan Carpenter dan.carpenter@oracle.com --- drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c index f07a456506ef..3e33e85d8dbc 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c @@ -821,7 +821,7 @@ static ssize_t amdgpu_ras_debugfs_table_read(struct file *f, char __user *buf, struct amdgpu_ras *ras = amdgpu_ras_get_context(adev); struct amdgpu_ras_eeprom_control *control = &ras->eeprom_control; const size_t orig_size = size; - int res = -EINVAL; + int res = -EFAULT; size_t data_len;

mutex_lock(&control->ras_tbl_mutex); @@ -912,8 +912,10 @@ static ssize_t amdgpu_ras_debugfs_table_read(struct file *f, char __user *buf, record.retired_page);

data_len = min_t(size_t, rec_hdr_fmt_size - r, size); - if (copy_to_user(buf, &data[r], data_len)) - return -EINVAL; + if (copy_to_user(buf, &data[r], data_len)) { + res = -EFAULT; + goto Out; + } buf += data_len; size -= data_len; *pos += data_len;

Series is, Reviewed-by: Luben Tuikov luben.tuikov@amd.com

Regards, Luben

On 2021-07-03 5:44 a.m., Dan Carpenter wrote:

If amdgpu_eeprom_read() returns a negative error code then the error handling checks:

if (res < buf_size) {

The problem is that "buf_size" is a u32 so negative values are type promoted to a high positive values and the condition is false. Fix this by changing the type of "buf_size" to int.

Fixes: 79beb6114014 ("drm/amdgpu: Optimize EEPROM RAS table I/O") Signed-off-by: Dan Carpenter dan.carpenter@oracle.com

---

It's hard for me to tell the exact upper bound that "buf_size" can be, but if it's over USHRT_MAX then we are well toasted.

drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c index fc70620369e4..f07a456506ef 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c @@ -978,9 +978,8 @@ const struct file_operations amdgpu_ras_debugfs_eeprom_table_ops = { static int __verify_ras_table_checksum(struct amdgpu_ras_eeprom_control *control) { struct amdgpu_device *adev = to_amdgpu_device(control);

• int res;

• int buf_size, res; u8 csum, *buf, *pp;

• u32 buf_size;

  buf_size = RAS_TABLE_HEADER_SIZE + control->ras_num_recs * RAS_TABLE_RECORD_SIZE;