[PATCH 1/4] drm/amdgpu: fix a signedness bug in __verify_ras_table_checksum()

[Luben Tuikov]

Series is,
Reviewed-by: Luben Tuikov <luben.tuikov at amd.com>

Regards,
Luben

On 2021-07-03 5:44 a.m., Dan Carpenter wrote:
> If amdgpu_eeprom_read() returns a negative error code then the error
> handling checks:
>
> 	if (res < buf_size) {
>
> The problem is that "buf_size" is a u32 so negative values are type
> promoted to a high positive values and the condition is false.  Fix
> this by changing the type of "buf_size" to int.
>
> Fixes: 79beb6114014 ("drm/amdgpu: Optimize EEPROM RAS table I/O")
> Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
> ---
> It's hard for me to tell the exact upper bound that "buf_size" can be,
> but if it's over USHRT_MAX then we are well toasted.
>
>  drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
> index fc70620369e4..f07a456506ef 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
> @@ -978,9 +978,8 @@ const struct file_operations amdgpu_ras_debugfs_eeprom_table_ops = {
>  static int __verify_ras_table_checksum(struct amdgpu_ras_eeprom_control *control)
>  {
>  	struct amdgpu_device *adev = to_amdgpu_device(control);
> -	int res;
> +	int buf_size, res;
>  	u8  csum, *buf, *pp;
> -	u32 buf_size;
>  
>  	buf_size = RAS_TABLE_HEADER_SIZE +
>  		control->ras_num_recs * RAS_TABLE_RECORD_SIZE;