From 90ef1dcb1d2bb84ad998e845e26a2a297a7ddfd6 Mon Sep 17 00:00:00 2001 From: Srinivasan Shanmugam Date: Thu, 23 Oct 2025 10:52:21 +0530 Subject: drm/amdgpu: Fix pointer casts when reading dynamic region sizes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The function amdgpu_virt_get_dynamic_data_info() writes a 64-bit size value. In two places (amdgpu_bios.c and amdgpu_discovery.c), the code passed the address of a smaller variable by casting it to u64 *, which is unsafe. This could make the function write more bytes than the smaller variable can hold, possibly overwriting nearby memory. Reported by static analysis tools. v2: Dynamic region size comes from the host (SR-IOV setup) and is always fixed to 5 MB. (Lijo/Ellen) 5 MB easily fits inside a 32-bit value, so using a 64-bit type is not needed. It also avoids extra type casts Fixes: b4a8fcc7826a ("drm/amdgpu: Add logic for VF ipd and VF bios to init from dynamic crit_region offsets") Reported by: Dan Carpenter Cc: Ellen Pan Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c') diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c index a7cb4665f485..fa2a22dfa048 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c @@ -311,7 +311,7 @@ static int amdgpu_discovery_read_binary_from_mem(struct amdgpu_device *adev, */ if (amdgpu_virt_get_dynamic_data_info(adev, AMD_SRIOV_MSG_IPD_TABLE_ID, binary, - (uint64_t *)&adev->discovery.size)) { + &adev->discovery.size)) { dev_err(adev->dev, "failed to read discovery info from dynamic critical region."); ret = -EINVAL; -- cgit v1.2.3