]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
drm/amdgu: fix Unintentional integer overflow for mall size
authorJesse Zhang <jesse.zhang@amd.com>
Wed, 29 May 2024 09:29:01 +0000 (17:29 +0800)
committerAlex Deucher <alexander.deucher@amd.com>
Wed, 5 Jun 2024 14:58:36 +0000 (10:58 -0400)
Potentially overflowing expression mall_size_per_umc * adev->gmc.num_umc with type unsigned int (32 bits, unsigned)
is evaluated using 32-bit arithmetic,and then used in a context that expects an expression of type u64 (64 bits, unsigned).

Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c

index 87b31ed8de19d8cb6f21eab340918b43df348bdd..c71356cb393d1d756b6c2d5bec00d7c65bb691a8 100644 (file)
@@ -1629,7 +1629,7 @@ static int amdgpu_discovery_get_mall_info(struct amdgpu_device *adev)
                break;
        case 2:
                mall_size_per_umc = le32_to_cpu(mall_info->v2.mall_size_per_umc);
-               adev->gmc.mall_size = mall_size_per_umc * adev->gmc.num_umc;
+               adev->gmc.mall_size = (uint64_t)mall_size_per_umc * adev->gmc.num_umc;
                break;
        default:
                dev_err(adev->dev,