From: hackyzh002 <[email protected]> commit 87c2213e85bd81e4a9a4d0880c256568794ae388 upstream.
The type of size is unsigned int, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later. Reviewed-by: Christian König <[email protected]> Signed-off-by: hackyzh002 <[email protected]> Signed-off-by: Alex Deucher <[email protected]> Signed-off-by: Roman Demidov <[email protected]> --- Backport fix for BDU:2026-01386 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index addeda42339f..4e20daa34305 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -100,7 +100,8 @@ static int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, union drm_amdgpu_cs struct amdgpu_vm *vm = &fpriv->vm; uint64_t *chunk_array_user; uint64_t *chunk_array; - unsigned size, num_ibs = 0; + size_t size; + unsigned int num_ibs = 0; uint32_t uf_offset = 0; int i; int ret; -- 2.53.0
