https://bugzilla.kernel.org/show_bug.cgi?id=194579 --- Comment #6 from PaX Team (pageexec@xxxxxxxxxxx) --- ``` (In reply to Christian König from comment #4) > Now back to topic, what code base is this? Could you post the branch > you are using somewhere? it's vanilla 4.9.9 + grsecurity (we don't change the amdgpu code except for some function pointer correctness issues). > In the upstream kernel the line at ttm_bo.c:388 is just an assignment > and can't cause any overflow. yet it does ;). here's the code in context, just to make sure we're talking about the same thing: 387 if (bo->mem.mm_node) { 388 bo->offset = (bo->mem.start << PAGE_SHIFT) + 389 bdev->man[bo->mem.mem_type].gpu_offset; 390 bo->cur_placement = bo->mem.placement; as you can see from the printk log, bo->mem.start was LONG_MAX (probably via AMDGPU_BO_INVALID_OFFSET) and shifting it left triggered our size overflow instrumentation. my guess is that AMDGPU_BO_INVALID_OFFSET isn't supposed to be used in offset calculations and thus there's some higher level logic bug here where the mem.start field should have been initialized by the time we got here. some casual code browsing points at amdgpu_ttm_placement_init that probably initializes the ttm_placement structures for amdgpu but for some of them it doesn't set any of fpfn/lpfn/TTM_PL_FLAG_TOPDOWN which is what would trigger the initialization of mem.start in amdgpu_gtt_mgr_new. ``` -- You are receiving this mail because: You are watching the assignee of the bug. _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/dri-devel
