Alex,
I think we should pull these through amd-staging-drm-next.
Regards,
Luben
On 2021-07-04 11:18 a.m., Luben Tuikov wrote:
> Series is,
> Reviewed-by: Luben Tuikov <luben.tuikov@xxxxxxx>
>
> Regards,
> Luben
>
> On 2021-07-03 5:44 a.m., Dan Carpenter wrote:
>> If amdgpu_eeprom_read() returns a negative error code then the error
>> handling checks:
>>
>> if (res < buf_size) {
>>
>> The problem is that "buf_size" is a u32 so negative values are type
>> promoted to a high positive values and the condition is false. Fix
>> this by changing the type of "buf_size" to int.
>>
>> Fixes: 79beb6114014 ("drm/amdgpu: Optimize EEPROM RAS table I/O")
>> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
>> ---
>> It's hard for me to tell the exact upper bound that "buf_size" can be,
>> but if it's over USHRT_MAX then we are well toasted.
>>
>> drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 3 +--
>> 1 file changed, 1 insertion(+), 2 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
>> index fc70620369e4..f07a456506ef 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
>> @@ -978,9 +978,8 @@ const struct file_operations amdgpu_ras_debugfs_eeprom_table_ops = {
>> static int __verify_ras_table_checksum(struct amdgpu_ras_eeprom_control *control)
>> {
>> struct amdgpu_device *adev = to_amdgpu_device(control);
>> - int res;
>> + int buf_size, res;
>> u8 csum, *buf, *pp;
>> - u32 buf_size;
>>
>> buf_size = RAS_TABLE_HEADER_SIZE +
>> control->ras_num_recs * RAS_TABLE_RECORD_SIZE;
