[PATCH] Fix out-of-bound access for gfx_v10_0_ring_test_ib()

[Haohui Mai]

Thanks for the prompt reviews. Here is the updated patch.

Signed-off-by: Haohui Mai <ricetons at gmail.com>
---
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
index 9426e252d8aa..c15549bbe636 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -3830,8 +3830,7 @@ static int gfx_v10_0_ring_test_ib(struct
amdgpu_ring *ring, long timeout)
        gpu_addr = adev->wb.gpu_addr + (index * 4);
        adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD);
        memset(&ib, 0, sizeof(ib));
-       r = amdgpu_ib_get(adev, NULL, 16,
-                                       AMDGPU_IB_POOL_DIRECT, &ib);
+       r = amdgpu_ib_get(adev, NULL, 20, AMDGPU_IB_POOL_DIRECT, &ib);
        if (r)
                goto err1;

--
2.25.1

On Mon, Apr 25, 2022 at 6:52 PM Christian König
<ckoenig.leichtzumerken at gmail.com> wrote:
>
> Am 25.04.22 um 10:56 schrieb Haohui Mai:
> > The gfx_v10_0_ring_test_ib() function uses 20 bytes instead of 16
> > bytes during the test. The patch sets the size of the allocation to be
> > 4-byte larger to match the actual usage.
> >
> > Signed-off-by: Haohui Mai <ricetons at gmail.com>
> > ---
> >   drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> > b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> > index 9426e252d8aa..b131235826b1 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> > @@ -3830,7 +3830,7 @@ static int gfx_v10_0_ring_test_ib(struct
> > amdgpu_ring *ring, long timeout)
> >          gpu_addr = adev->wb.gpu_addr + (index * 4);
> >          adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD);
> >          memset(&ib, 0, sizeof(ib));
> > -       r = amdgpu_ib_get(adev, NULL, 16,
> > +       r = amdgpu_ib_get(adev, NULL, 20,
> >                                          AMDGPU_IB_POOL_DIRECT, &ib);
>
> Good catch, but while at it please fix the coding style and move the
> "AMDGPU_IB_POOL_DIRECT, &ib);" on the same line as well.
>
> With that done, the patch is Reviewed-by: Christian König
> <christian.koenig at amd.com>
>
> >          if (r)
> >                  goto err1;
> > --
> > 2.25.1
>