diff options
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c index 66e9cd103597..f2ce8f506aa8 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c @@ -937,9 +937,10 @@ static uint8_t amdgpu_virt_crit_region_calc_checksum(uint8_t *buf_start, uint8_t int amdgpu_virt_init_critical_region(struct amdgpu_device *adev) { struct amd_sriov_msg_init_data_header *init_data_hdr = NULL; - uint32_t init_hdr_offset = adev->virt.init_data_header.offset; - uint32_t init_hdr_size = adev->virt.init_data_header.size_kb << 10; - uint64_t vram_size; + u64 init_hdr_offset = adev->virt.init_data_header.offset; + u64 init_hdr_size = (u64)adev->virt.init_data_header.size_kb << 10; /* KB → bytes */ + u64 vram_size; + u64 end; int r = 0; uint8_t checksum = 0; @@ -957,7 +958,7 @@ int amdgpu_virt_init_critical_region(struct amdgpu_device *adev) return -EINVAL; vram_size <<= 20; - if ((init_hdr_offset + init_hdr_size) > vram_size) { + if (check_add_overflow(init_hdr_offset, init_hdr_size, &end) || end > vram_size) { dev_err(adev->dev, "init_data_header exceeds VRAM size, exiting\n"); return -EINVAL; } @@ -1101,7 +1102,7 @@ out: } int amdgpu_virt_get_dynamic_data_info(struct amdgpu_device *adev, - int data_id, uint8_t *binary, uint64_t *size) + int data_id, uint8_t *binary, u32 *size) { uint32_t data_offset = 0; uint32_t data_size = 0; |