Am 19.04.23 um 10:27 schrieb hackyzh002:

The type of size is unsigned int, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later.

Signed-off-by: hackyzh002 hackyzh002@gmail.com

drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index 08eced097..c17b3af85 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -192,7 +192,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, uint64_t *chunk_array_user; uint64_t *chunk_array; uint32_t uf_offset = 0;

• unsigned int size;

• size_t size; int ret; int i;

@@ -235,7 +235,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, size = p->chunks[i].length_dw; cdata = u64_to_user_ptr(user_chunk.chunk_data);

• p->chunks[i].kdata = kvmalloc_array(size, sizeof(uint32_t),
  

• p->chunks[i].kdata = kvcalloc(size, sizeof(uint32_t),
  

Again, please drop that part of the patch. This is superfluous.

Regards, Christian.

				    GFP_KERNEL);
if (p->chunks[i].kdata == NULL) {
	ret = -ENOMEM;