[PATCH 2/2] drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1

2023-04-19 Thread hackyzh002
The type of size is unsigned int, if size is 0x4000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later. Signed-off-by: hackyzh002 --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ++-- 1 file changed, 2

[PATCH V3 1/2] drm/radeon: Fix integer overflow in radeon_cs_parser_init

2023-04-19 Thread hackyzh002
The type of size is unsigned, if size is 0x4000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later Signed-off-by: hackyzh002 --- drivers/gpu/drm/radeon/radeon_cs.c | 3 ++- 1 file changed, 2 insertions

[PATCH v2 1/2] drm/radeon: Fix integer overflow in radeon_cs_parser_init

2023-04-19 Thread hackyzh002
The type of size is unsigned, if size is 0x4000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later Signed-off-by: hackyzh002 --- drivers/gpu/drm/radeon/radeon_cs.c | 2 +- 1 file changed, 1 insertion

[PATCH 1/2] drm/radeon: Fix integer overflow in radeon_cs_parser_init

2023-04-19 Thread hackyzh002
The type of size is unsigned, if size is 0x4000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later Signed-off-by: hackyzh002 --- drivers/gpu/drm/radeon/radeon_cs.c | 4 ++-- 1 file changed, 2

[PATCH v3 2/2] drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1

2023-04-19 Thread hackyzh002
The type of size is unsigned int, if size is 0x4000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later. Signed-off-by: hackyzh002 --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- 1 file changed, 1

[PATCH V2 2/2] drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1

2023-04-19 Thread hackyzh002
The type of size is unsigned int, if size is 0x4000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later. Signed-off-by: hackyzh002 --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ++-- 1 file changed, 2