This reverts commit 7ccd781794d247589104a791caab491e21218fba.
The origin mainline patch fix a buffer overflow issue in
amdgpu_debugfs_gprwave_read(), but it has not been introduced in kernel
6.1 and older kernels. This patch add a check in a wrong function in the
same file.
Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
index fa42b3c7e1b3..48b8b5600402 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -395,7 +395,7 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf,
if (!adev->smc_rreg)
return -EOPNOTSUPP;
- if (size > 4096 || size & 0x3 || *pos & 0x3)
+ if (size & 0x3 || *pos & 0x3)
return -EINVAL;
while (size) {
--
2.17.1
This reverts commit aaf6160a4b7f9ee3cd91aa5b3251f5dbe2170f42.
The origin mainline patch fix a buffer overflow issue in
amdgpu_debugfs_gprwave_read(), but it has not been introduced in kernel
6.1 and older kernels. This patch add a check in a wrong function in the
same file.
Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
index 2ca7a5d5ea64..49711776b351 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -401,7 +401,7 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user
ssize_t result = 0;
int r;
- if (size > 4096 || size & 0x3 || *pos & 0x3)
+ if (size & 0x3 || *pos & 0x3)
return -EINVAL;
if (!adev->didt_wreg)
--
2.17.1
Hi all.
The upstream kernels late than v6.10-rc6 has the patch:
7d79cd784470 udmabuf: use vmf_insert_pfn and VM_PFNMAP for handling mmap
That patch stop reproducing syzbot crashes [1], [2].
The reproducer code [3] still crash longterm & stable kernel versions v5.4-v6.6.
Here the 7d79cd784470 backports below.
Patch v6.6 just cherry-picked, patch for v5.4-v6.1 has minor change described
in the patch note.
Regards,
AK
[1] https://syzkaller.appspot.com/bug?extid=3d218f7b6c5511a83a79
[2] https://syzkaller.appspot.com/bug?extid=17a207d226b8a5fb0fd9
[3] https://syzkaller.appspot.com/text?tag=ReproC&x=10c0b8c0580000
Reported-by: syzbot+3d218f7b6c5511a83a79(a)syzkaller.appspotmail.com
Reported-by: syzbot+17a207d226b8a5fb0fd9(a)syzkaller.appspotmail.com
This reverts commit 25d7e84343e1235b667cf5226c3934fdf36f0df6.
The origin mainline patch fix a buffer overflow issue in
amdgpu_debugfs_gprwave_read(), but it has not been introduced in kernel
6.1 and older kernels. This patch add a check in a wrong function in the
same file.
Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
index a8dd63f270c3..3cca3f07f34d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -419,7 +419,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_write(struct file *f, const char __user
ssize_t result = 0;
int r;
- if (size > 4096 || size & 0x3 || *pos & 0x3)
+ if (size & 0x3 || *pos & 0x3)
return -EINVAL;
r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
--
2.17.1
This reverts commit 17f5f18085acb5e9d8d13d84a4e12bb3aff2bd64.
The origin mainline patch fix a buffer overflow issue in
amdgpu_debugfs_gprwave_read(), but it has not been introduced in kernel
6.1 and older kernels. This patch add a check in a wrong function in the
same file.
Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
index 3cca007a0cd0..8a1cb1de2b13 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -396,7 +396,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_write(struct file *f, const char __user
ssize_t result = 0;
int r;
- if (size > 4096 || size & 0x3 || *pos & 0x3)
+ if (size & 0x3 || *pos & 0x3)
return -EINVAL;
r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
--
2.17.1