]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/amdgpu: Make SR-IOV critical region checks overflow-safe
authorSrinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Wed, 22 Oct 2025 12:16:26 +0000 (17:46 +0530)
committerAlex Deucher <alexander.deucher@amd.com>
Tue, 28 Oct 2025 13:52:44 +0000 (09:52 -0400)
commit00dc2ff519781309f1f1ff344a638f61c33884c7
treee57777d259059535c0c19d91c6c5ea4404dd27cb
parent102c4f7c554ac5a5ecf0023fa0612beb58e3b0bd
drm/amdgpu: Make SR-IOV critical region checks overflow-safe

The function amdgpu_virt_init_critical_region() contained an invalid
check for a negative init_hdr_offset value:

    if (init_hdr_offset < 0)

Since init_hdr_offset is an unsigned 32-bit integer, this condition can
never be true and triggers a Smatch warning:

    warn: unsigned 'init_hdr_offset' is never less than zero

In addition, the subsequent bounds check: if ((init_hdr_offset +
init_hdr_size) > vram_size) was vulnerable to integer overflow when
adding the two unsigned values.  Thus, by promoting offset and size to
64-bit and using check_add_overflow() to safely validate the sum against
VRAM size.

Fixes: 07009df6494d ("drm/amdgpu: Introduce SRIOV critical regions v2 during VF init")
Reported by: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Ellen Pan <yunru.pan@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Ellen Pan <yunru.pan@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c