[PATCH 0/5] drm/amd/pm: Prevent division by zero

[PATCH 0/5] drm/amd/pm: Prevent division by zero

[Denis Arefev]

This series of patches prevents possible division by zero.

The user can set any speed value.
If speed is greater than UINT_MAX/8, division by zero is possible.

Found by Linux Verification Center (linuxtesting.org) with SVACE. 

Denis Arefev (5):
  drm/amd/pm: Prevent division by zero
  drm/amd/pm: Prevent division by zero
  drm/amd/pm: Prevent division by zero
  drm/amd/pm: Prevent division by zero
  drm/amd/pm: Prevent division by zero

 drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c   | 6 +++---
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c | 4 ++--
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c | 2 +-
 drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c       | 3 +++
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c          | 2 +-
 5 files changed, 10 insertions(+), 7 deletions(-)

I did not change these files, because the functions you are 
interested in are not used there for a long time.
drivers/gpu/drm/radeon/si_dpm.c
drivers/gpu/drm/radeon/ci_dpm.c

-- 
2.43.0

[PATCH 1/5] drm/amd/pm: Prevent division by zero

[Denis Arefev]

The user can set any speed value.
If speed is greater than UINT_MAX/8, division by zero is possible.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: c05d1c401572 ("drm/amd/swsmu: add aldebaran smu13 ip support (v3)")
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index fbbdfa54f6a2..b508d475d2e1 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -1229,7 +1229,7 @@ int smu_v13_0_set_fan_speed_rpm(struct smu_context *smu,
 	uint32_t tach_period;
 	int ret;
 
-	if (!speed)
+	if (!speed || speed > UINT_MAX/8)
 		return -EINVAL;
 
 	ret = smu_v13_0_auto_fan_control(smu, 0);
-- 
2.43.0

[PATCH 2/5] drm/amd/pm: Prevent division by zero

[Denis Arefev]

The user can set any speed value.
If speed is greater than UINT_MAX/8, division by zero is possible.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: b64625a303de ("drm/amd/pm: correct the address of Arcturus fan related registers")
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
 drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
index 8aa61a9f7778..453952cdc353 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
@@ -1267,6 +1267,9 @@ static int arcturus_set_fan_speed_rpm(struct smu_context *smu,
 	uint32_t crystal_clock_freq = 2500;
 	uint32_t tach_period;
 
+	if (!speed || speed > UINT_MAX/8)
+		return -EINVAL;
+
 	tach_period = 60 * crystal_clock_freq * 10000 / (8 * speed);
 	WREG32_SOC15(THM, 0, mmCG_TACH_CTRL_ARCT,
 		     REG_SET_FIELD(RREG32_SOC15(THM, 0, mmCG_TACH_CTRL_ARCT),
-- 
2.43.0

[PATCH 3/5] drm/amd/pm: Prevent division by zero

[Denis Arefev]

The user can set any speed value.
If speed is greater than UINT_MAX/8, division by zero is possible.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 031db09017da ("drm/amd/powerplay/vega20: enable fan RPM and pwm settings V2")
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c
index a3331ffb2daf..1b1c88590156 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c
@@ -191,7 +191,7 @@ int vega20_fan_ctrl_set_fan_speed_rpm(struct pp_hwmgr *hwmgr, uint32_t speed)
 	uint32_t tach_period, crystal_clock_freq;
 	int result = 0;
 
-	if (!speed)
+	if (!speed || speed > UINT_MAX/8)
 		return -EINVAL;
 
 	if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) {
-- 
2.43.0

Re: [PATCH 0/5] drm/amd/pm: Prevent division by zero

[Alex Deucher]

On Fri, Mar 21, 2025 at 6:53 AM Denis Arefev <arefev@swemel.ru> wrote:
>
> This series of patches prevents possible division by zero.
>
> The user can set any speed value.
> If speed is greater than UINT_MAX/8, division by zero is possible.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.

Applied the series.  Thanks!

Alex

>
> Denis Arefev (5):
>   drm/amd/pm: Prevent division by zero
>   drm/amd/pm: Prevent division by zero
>   drm/amd/pm: Prevent division by zero
>   drm/amd/pm: Prevent division by zero
>   drm/amd/pm: Prevent division by zero
>
>  drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c   | 6 +++---
>  drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c | 4 ++--
>  drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c | 2 +-
>  drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c       | 3 +++
>  drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c          | 2 +-
>  5 files changed, 10 insertions(+), 7 deletions(-)
>
> I did not change these files, because the functions you are
> interested in are not used there for a long time.
> drivers/gpu/drm/radeon/si_dpm.c
> drivers/gpu/drm/radeon/ci_dpm.c
>
> --
> 2.43.0
>