Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8feaccf7 authored by Dan Carpenter's avatar Dan Carpenter Committed by Oded Gabbay
Browse files

drm/amdkfd: Integer overflows in ioctl 



args->n_devices is a u32 that comes from the user.  The multiplication
could overflow on 32 bit systems possibly leading to privilege
escalation.

Fixes: 5ec7e028 ("drm/amdkfd: Add ioctls for GPUVM memory management")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: default avatarOded Gabbay <oded.gabbay@gmail.com>
parent 389056e5

drivers/gpu/drm/amd/amdkfd/kfd_chardev.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -1303,7 +1303,7 @@ static int kfd_ioctl_map_memory_to_gpu(struct file *filep, 
		return -EINVAL;

		return -EINVAL;

	}

	}





	devices_arr = kmalloc(args->n_devices * sizeof(*devices_arr),

	devices_arr = kmalloc_array(args->n_devices, sizeof(*devices_arr),

				    GFP_KERNEL);

				    GFP_KERNEL);

	if (!devices_arr)

	if (!devices_arr)

		return -ENOMEM;

		return -ENOMEM;
@@ -1412,7 +1412,7 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep, 
		return -EINVAL;

		return -EINVAL;

	}

	}





	devices_arr = kmalloc(args->n_devices * sizeof(*devices_arr),

	devices_arr = kmalloc_array(args->n_devices, sizeof(*devices_arr),

				    GFP_KERNEL);

				    GFP_KERNEL);

	if (!devices_arr)

	if (!devices_arr)

		return -ENOMEM;

		return -ENOMEM;