]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
drm/radeon: Fix integer overflow in radeon_cs_parser_init
authorhackyzh002 <hackyzh002@gmail.com>
Wed, 19 Apr 2023 12:20:58 +0000 (20:20 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 30 Aug 2023 14:35:08 +0000 (16:35 +0200)
commitd05ba46134d07e889de7d23cf8503574a22ede09
treed10d3cbc5417e82486db1e02cf7bb4d7c59f9243
parent23de80469a4b113fcc9cd9dae5770e7ad8d45296
drm/radeon: Fix integer overflow in radeon_cs_parser_init

[ Upstream commit f828b681d0cd566f86351c0b913e6cb6ed8c7b9c ]

The type of size is unsigned, if size is 0x40000000, there will be an
integer overflow, size will be zero after size *= sizeof(uint32_t),
will cause uninitialized memory to be referenced later

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: hackyzh002 <hackyzh002@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/gpu/drm/radeon/radeon_cs.c