]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
authorIgor Artemiev <Igor.A.Artemiev@mcst.ru>
Fri, 27 Sep 2024 15:07:19 +0000 (18:07 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 14 Dec 2024 18:51:36 +0000 (19:51 +0100)
commit6078d3ca132bf5f1dc4d895d58a760e11f2de39e
tree4f03e06d14881190dd5b2d916bd776688e7d1063
parentf632b3be8ee809fca65e6bb8d58b4fe674ecd162
drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()

[ Upstream commit a1e2da6a5072f8abe5b0feaa91a5bcd9dc544a04 ]

It is possible, although unlikely, that an integer overflow will occur
when the result of radeon_get_ib_value() is shifted to the left.

Avoid it by casting one of the operands to larger data type (u64).

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Signed-off-by: Igor Artemiev <Igor.A.Artemiev@mcst.ru>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/gpu/drm/radeon/r600_cs.c