diff options
| author | Haohui Mai <ricetons@gmail.com> | 2022-04-25 16:56:05 +0800 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2022-04-26 11:44:09 -0400 |
| commit | 428f273cbb3f1349d27716bce0d7bd4dbfb4837f (patch) | |
| tree | ba017013f67ce2a8b471e2306b707649eb4d23ef /drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | |
| parent | ca5d251b3b6e3aabf2d1bb7261c6b8e156b7ee16 (diff) | |
drm/amdgpu: Fix out-of-bound access for gfx_v10_0_ring_test_ib()
The gfx_v10_0_ring_test_ib() function uses 20 bytes instead of 16
bytes during the test. The patch sets the size of the allocation to be
4-byte larger to match the actual usage.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Haohui Mai <ricetons@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c index 54446162db8b..407074f958f4 100644 --- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c @@ -3830,8 +3830,7 @@ static int gfx_v10_0_ring_test_ib(struct amdgpu_ring *ring, long timeout) gpu_addr = adev->wb.gpu_addr + (index * 4); adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD); memset(&ib, 0, sizeof(ib)); - r = amdgpu_ib_get(adev, NULL, 16, - AMDGPU_IB_POOL_DIRECT, &ib); + r = amdgpu_ib_get(adev, NULL, 20, AMDGPU_IB_POOL_DIRECT, &ib); if (r) goto err1; |