[PATCH] Fix out-of-bound access for gfx_v10_0_ring_test_ib()

[Christian König]

Am 25.04.22 um 10:56 schrieb Haohui Mai:
> The gfx_v10_0_ring_test_ib() function uses 20 bytes instead of 16
> bytes during the test. The patch sets the size of the allocation to be
> 4-byte larger to match the actual usage.
>
> Signed-off-by: Haohui Mai <ricetons at gmail.com>
> ---
>   drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> index 9426e252d8aa..b131235826b1 100644
> --- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> @@ -3830,7 +3830,7 @@ static int gfx_v10_0_ring_test_ib(struct
> amdgpu_ring *ring, long timeout)
>          gpu_addr = adev->wb.gpu_addr + (index * 4);
>          adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD);
>          memset(&ib, 0, sizeof(ib));
> -       r = amdgpu_ib_get(adev, NULL, 16,
> +       r = amdgpu_ib_get(adev, NULL, 20,
>                                          AMDGPU_IB_POOL_DIRECT, &ib);

Good catch, but while at it please fix the coding style and move the 
"AMDGPU_IB_POOL_DIRECT, &ib);" on the same line as well.

With that done, the patch is Reviewed-by: Christian König 
<christian.koenig at amd.com>

>          if (r)
>                  goto err1;
> --
> 2.25.1