Commit 041bf022 authored by Dan Carpenter's avatar Dan Carpenter Committed by Alex Deucher
Browse files

drm/amdgpu: missing bounds check in amdgpu_set_pp_force_state() 



There is no limit on high "idx" can go.  It should be less than
ARRAY_SIZE(data.states) which is 16.

The "data" variable wasn't declared in that scope so I shifted the code
around a bit to make it work.  Also I made "idx" unsigned.

Fixes: f3898ea1 ('drm/amd/powerplay: add some sysfs interfaces for powerplay.')
Acked-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 0ab15bde

drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c

+13 −15
Original line number Original line Diff line number Diff line
@@ -270,21 +270,20 @@ static ssize_t amdgpu_set_pp_force_state(struct device *dev, 
	struct drm_device *ddev = dev_get_drvdata(dev);

	struct drm_device *ddev = dev_get_drvdata(dev);

	struct amdgpu_device *adev = ddev->dev_private;

	struct amdgpu_device *adev = ddev->dev_private;

	enum amd_pm_state_type state = 0;

	enum amd_pm_state_type state = 0;

	long idx;

	unsigned long idx;

	int ret;

	int ret;





	if (strlen(buf) == 1)

	if (strlen(buf) == 1)

		adev->pp_force_state_enabled = false;

		adev->pp_force_state_enabled = false;

	else {

	else if (adev->pp_enabled) {

		ret = kstrtol(buf, 0, &idx);

		struct pp_states_info data;





		if (ret) {

		ret = kstrtoul(buf, 0, &idx);

		if (ret || idx >= ARRAY_SIZE(data.states)) {

			count = -EINVAL;

			count = -EINVAL;

			goto fail;

			goto fail;

		}

		}





		if (adev->pp_enabled) {

			struct pp_states_info data;

		amdgpu_dpm_get_pp_num_states(adev, &data);

		amdgpu_dpm_get_pp_num_states(adev, &data);

		state = data.states[idx];

		state = data.states[idx];

		/* only set user selected power states */

		/* only set user selected power states */
@@ -295,7 +294,6 @@ static ssize_t amdgpu_set_pp_force_state(struct device *dev, 
			adev->pp_force_state_enabled = true;

			adev->pp_force_state_enabled = true;

		}

		}

	}

	}

	}

fail:

fail:

	return count;

	return count;

}

}