|
| 1 | +drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' |
| 2 | + |
| 3 | +jira LE-3201 |
| 4 | +cve CVE-2024-27042 |
| 5 | +Rebuild_History Non-Buildable kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 |
| 6 | +commit-author Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> |
| 7 | +commit cdb637d339572398821204a1142d8d615668f1e9 |
| 8 | +Empty-Commit: Cherry-Pick Conflicts during history rebuild. |
| 9 | +Will be included in final tarball splat. Ref for failed cherry-pick at: |
| 10 | +ciq/ciq_backports/kernel-rt-4.18.0-553.22.1.rt7.363.el8_10/cdb637d3.failed |
| 11 | + |
| 12 | +The issue arises when the array 'adev->vcn.vcn_config' is accessed |
| 13 | +before checking if the index 'adev->vcn.num_vcn_inst' is within the |
| 14 | +bounds of the array. |
| 15 | + |
| 16 | +The fix involves moving the bounds check before the array access. This |
| 17 | +ensures that 'adev->vcn.num_vcn_inst' is within the bounds of the array |
| 18 | +before it is used as an index. |
| 19 | + |
| 20 | +Fixes the below: |
| 21 | +drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1289 amdgpu_discovery_reg_base_init() error: testing array offset 'adev->vcn.num_vcn_inst' after use. |
| 22 | + |
| 23 | +Fixes: a0ccc717c4ab ("drm/amdgpu/discovery: validate VCN and SDMA instances") |
| 24 | + Cc: Christian König <christian.koenig@amd.com> |
| 25 | + Cc: Alex Deucher <alexander.deucher@amd.com> |
| 26 | + Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> |
| 27 | + Reviewed-by: Alex Deucher <alexander.deucher@amd.com> |
| 28 | + Signed-off-by: Alex Deucher <alexander.deucher@amd.com> |
| 29 | +(cherry picked from commit cdb637d339572398821204a1142d8d615668f1e9) |
| 30 | + Signed-off-by: Jonathan Maple <jmaple@ciq.com> |
| 31 | + |
| 32 | +# Conflicts: |
| 33 | +# drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c |
| 34 | +diff --cc drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c |
| 35 | +index c65765f9aad1,118288b64487..000000000000 |
| 36 | +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c |
| 37 | ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c |
| 38 | +@@@ -1141,15 -1282,21 +1141,27 @@@ static int amdgpu_discovery_reg_base_in |
| 39 | + * 0b10 : encode is disabled |
| 40 | + * 0b01 : decode is disabled |
| 41 | + */ |
| 42 | +++<<<<<<< HEAD |
| 43 | + + adev->vcn.vcn_config[adev->vcn.num_vcn_inst] = |
| 44 | + + ip->revision & 0xc0; |
| 45 | + + ip->revision &= ~0xc0; |
| 46 | + + if (adev->vcn.num_vcn_inst < AMDGPU_MAX_VCN_INSTANCES) |
| 47 | +++======= |
| 48 | ++ if (adev->vcn.num_vcn_inst < |
| 49 | ++ AMDGPU_MAX_VCN_INSTANCES) { |
| 50 | ++ adev->vcn.vcn_config[adev->vcn.num_vcn_inst] = |
| 51 | ++ ip->revision & 0xc0; |
| 52 | +++>>>>>>> cdb637d33957 (drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()') |
| 53 | + adev->vcn.num_vcn_inst++; |
| 54 | + - adev->vcn.inst_mask |= |
| 55 | + - (1U << ip->instance_number); |
| 56 | + - adev->jpeg.inst_mask |= |
| 57 | + - (1U << ip->instance_number); |
| 58 | + - } else { |
| 59 | + + else |
| 60 | + dev_err(adev->dev, "Too many VCN instances: %d vs %d\n", |
| 61 | + adev->vcn.num_vcn_inst + 1, |
| 62 | + AMDGPU_MAX_VCN_INSTANCES); |
| 63 | +++<<<<<<< HEAD |
| 64 | +++======= |
| 65 | ++ } |
| 66 | ++ ip->revision &= ~0xc0; |
| 67 | +++>>>>>>> cdb637d33957 (drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()') |
| 68 | + } |
| 69 | + if (le16_to_cpu(ip->hw_id) == SDMA0_HWID || |
| 70 | + le16_to_cpu(ip->hw_id) == SDMA1_HWID || |
| 71 | +* Unmerged path drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c |
0 commit comments