[Bug 194579] AMDGPU: Possible size overflow detected by PaX in ttm_bo_handle_move_mem (drivers/gpu/drm/ttm/ttm_bo.c:388)

[bugzilla-daemon at bugzilla.kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=194579

--- Comment #6 from PaX Team (pageexec at freemail.hu) ---
```
(In reply to Christian König from comment #4)
> Now back to topic, what code base is this? Could you post the branch
> you are using somewhere?

it's vanilla 4.9.9 + grsecurity (we don't change the amdgpu code except for
some function pointer correctness issues).

> In the upstream kernel the line at ttm_bo.c:388 is just an assignment
> and can't cause any overflow.

yet it does ;). here's the code in context, just to make sure we're talking
about the same thing:

   387         if (bo->mem.mm_node) {
   388                 bo->offset = (bo->mem.start << PAGE_SHIFT) +
   389             bdev->man[bo->mem.mem_type].gpu_offset;
   390         bo->cur_placement = bo->mem.placement;

as you can see from the printk log, bo->mem.start was LONG_MAX (probably via
AMDGPU_BO_INVALID_OFFSET) and shifting it left triggered our size overflow
instrumentation. my guess is that AMDGPU_BO_INVALID_OFFSET isn't supposed to
be used in offset calculations and thus there's some higher level logic bug
here where the mem.start field should have been initialized by the time we
got here. some casual code browsing points at amdgpu_ttm_placement_init that
probably initializes the ttm_placement structures for amdgpu but for some of
them it doesn't set any of fpfn/lpfn/TTM_PL_FLAG_TOPDOWN which is what would
trigger the initialization of mem.start in amdgpu_gtt_mgr_new.
```

-- 
You are receiving this mail because:
You are watching the assignee of the bug.