Commit c915ef89 authored by Dan Carpenter's avatar Dan Carpenter Committed by Alex Deucher
Browse files

drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask() 



If the user passes a "level" value which is higher than 31 then that
leads to shift wrapping.  The undefined behavior will lead to a
syzkaller stack dump.

Fixes: 5632708f ("drm/amd/powerplay: add dpm force multiple levels on cz/tonga/fiji/polaris (v2)")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 4b1d6831

drivers/gpu/drm/amd/pm/amdgpu_pm.c

+3 −3
Original line number Diff line number Diff line
@@ -1095,7 +1095,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev, 
static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)

{

	int ret;

	long level;

	unsigned long level;

	char *sub_str = NULL;

	char *tmp;

	char buf_cpy[AMDGPU_MASK_BUF_MAX + 1];
@@ -1110,8 +1110,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask) 
	tmp = buf_cpy;

	while ((sub_str = strsep(&tmp, delimiter)) != NULL) {

		if (strlen(sub_str)) {

			ret = kstrtol(sub_str, 0, &level);

			if (ret)

			ret = kstrtoul(sub_str, 0, &level);

			if (ret || level > 31)

				return -EINVAL;

			*mask |= 1 << level;

		} else