[PATCH] Fix out-of-bound access for gfx_v10_0_ring_test_ib()

[Alex Deucher]

Applied, but please fix your mailer.  Also, please prepend patch
titles with "drm/amdgpu".

Thanks,

Alex


On Mon, Apr 25, 2022 at 7:03 AM Haohui Mai <ricetons at gmail.com> wrote:
>
> Thanks for the prompt reviews. Here is the updated patch.
>
> Signed-off-by: Haohui Mai <ricetons at gmail.com>
> ---
>  drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> index 9426e252d8aa..c15549bbe636 100644
> --- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> @@ -3830,8 +3830,7 @@ static int gfx_v10_0_ring_test_ib(struct
> amdgpu_ring *ring, long timeout)
>         gpu_addr = adev->wb.gpu_addr + (index * 4);
>         adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD);
>         memset(&ib, 0, sizeof(ib));
> -       r = amdgpu_ib_get(adev, NULL, 16,
> -                                       AMDGPU_IB_POOL_DIRECT, &ib);
> +       r = amdgpu_ib_get(adev, NULL, 20, AMDGPU_IB_POOL_DIRECT, &ib);
>         if (r)
>                 goto err1;
>
> --
> 2.25.1
>
> On Mon, Apr 25, 2022 at 6:52 PM Christian König
> <ckoenig.leichtzumerken at gmail.com> wrote:
> >
> > Am 25.04.22 um 10:56 schrieb Haohui Mai:
> > > The gfx_v10_0_ring_test_ib() function uses 20 bytes instead of 16
> > > bytes during the test. The patch sets the size of the allocation to be
> > > 4-byte larger to match the actual usage.
> > >
> > > Signed-off-by: Haohui Mai <ricetons at gmail.com>
> > > ---
> > >   drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +-
> > >   1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> > > b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> > > index 9426e252d8aa..b131235826b1 100644
> > > --- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> > > +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
> > > @@ -3830,7 +3830,7 @@ static int gfx_v10_0_ring_test_ib(struct
> > > amdgpu_ring *ring, long timeout)
> > >          gpu_addr = adev->wb.gpu_addr + (index * 4);
> > >          adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD);
> > >          memset(&ib, 0, sizeof(ib));
> > > -       r = amdgpu_ib_get(adev, NULL, 16,
> > > +       r = amdgpu_ib_get(adev, NULL, 20,
> > >                                          AMDGPU_IB_POOL_DIRECT, &ib);
> >
> > Good catch, but while at it please fix the coding style and move the
> > "AMDGPU_IB_POOL_DIRECT, &ib);" on the same line as well.
> >
> > With that done, the patch is Reviewed-by: Christian König
> > <christian.koenig at amd.com>
> >
> > >          if (r)
> > >                  goto err1;
> > > --
> > > 2.25.1
> >