From: Haohui Mai Date: Mon, 25 Apr 2022 08:56:05 +0000 (+0800) Subject: drm/amdgpu: Fix out-of-bound access for gfx_v10_0_ring_test_ib() X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=428f273cbb3f1349d27716bce0d7bd4dbfb4837f;p=linux.git drm/amdgpu: Fix out-of-bound access for gfx_v10_0_ring_test_ib() The gfx_v10_0_ring_test_ib() function uses 20 bytes instead of 16 bytes during the test. The patch sets the size of the allocation to be 4-byte larger to match the actual usage. Reviewed-by: Christian König Signed-off-by: Haohui Mai Signed-off-by: Alex Deucher --- diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c index 54446162db8b7..407074f958f47 100644 --- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c @@ -3830,8 +3830,7 @@ static int gfx_v10_0_ring_test_ib(struct amdgpu_ring *ring, long timeout) gpu_addr = adev->wb.gpu_addr + (index * 4); adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD); memset(&ib, 0, sizeof(ib)); - r = amdgpu_ib_get(adev, NULL, 16, - AMDGPU_IB_POOL_DIRECT, &ib); + r = amdgpu_ib_get(adev, NULL, 20, AMDGPU_IB_POOL_DIRECT, &ib); if (r) goto err1;