* [PATCH 1/5] drm/amd/pm: Prevent division by zero
2025-03-21 10:52 [PATCH 0/5] drm/amd/pm: Prevent division by zero Denis Arefev
@ 2025-03-21 10:52 ` Denis Arefev
2025-03-21 10:52 ` [PATCH 2/5] " Denis Arefev
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Denis Arefev @ 2025-03-21 10:52 UTC (permalink / raw)
To: Kenneth Feng
Cc: Alex Deucher, Christian König, David Airlie, Simona Vetter,
Lijo Lazar, Ma Jun, Mario Limonciello, Srinivasan Shanmugam,
Yang Wang, amd-gfx, dri-devel, linux-kernel, lvc-project
The user can set any speed value.
If speed is greater than UINT_MAX/8, division by zero is possible.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: c05d1c401572 ("drm/amd/swsmu: add aldebaran smu13 ip support (v3)")
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
index fbbdfa54f6a2..b508d475d2e1 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
@@ -1229,7 +1229,7 @@ int smu_v13_0_set_fan_speed_rpm(struct smu_context *smu,
uint32_t tach_period;
int ret;
- if (!speed)
+ if (!speed || speed > UINT_MAX/8)
return -EINVAL;
ret = smu_v13_0_auto_fan_control(smu, 0);
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 2/5] drm/amd/pm: Prevent division by zero
2025-03-21 10:52 [PATCH 0/5] drm/amd/pm: Prevent division by zero Denis Arefev
2025-03-21 10:52 ` [PATCH 1/5] " Denis Arefev
@ 2025-03-21 10:52 ` Denis Arefev
2025-03-21 10:52 ` [PATCH 3/5] " Denis Arefev
2025-03-21 13:40 ` [PATCH 0/5] " Alex Deucher
3 siblings, 0 replies; 5+ messages in thread
From: Denis Arefev @ 2025-03-21 10:52 UTC (permalink / raw)
To: Kenneth Feng
Cc: Alex Deucher, Christian König, David Airlie, Simona Vetter,
Lijo Lazar, Ma Jun, Kun Liu, Boyuan Zhang, Tim Huang, amd-gfx,
dri-devel, linux-kernel, lvc-project
The user can set any speed value.
If speed is greater than UINT_MAX/8, division by zero is possible.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: b64625a303de ("drm/amd/pm: correct the address of Arcturus fan related registers")
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
index 8aa61a9f7778..453952cdc353 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
@@ -1267,6 +1267,9 @@ static int arcturus_set_fan_speed_rpm(struct smu_context *smu,
uint32_t crystal_clock_freq = 2500;
uint32_t tach_period;
+ if (!speed || speed > UINT_MAX/8)
+ return -EINVAL;
+
tach_period = 60 * crystal_clock_freq * 10000 / (8 * speed);
WREG32_SOC15(THM, 0, mmCG_TACH_CTRL_ARCT,
REG_SET_FIELD(RREG32_SOC15(THM, 0, mmCG_TACH_CTRL_ARCT),
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 3/5] drm/amd/pm: Prevent division by zero
2025-03-21 10:52 [PATCH 0/5] drm/amd/pm: Prevent division by zero Denis Arefev
2025-03-21 10:52 ` [PATCH 1/5] " Denis Arefev
2025-03-21 10:52 ` [PATCH 2/5] " Denis Arefev
@ 2025-03-21 10:52 ` Denis Arefev
2025-03-21 13:40 ` [PATCH 0/5] " Alex Deucher
3 siblings, 0 replies; 5+ messages in thread
From: Denis Arefev @ 2025-03-21 10:52 UTC (permalink / raw)
To: Kenneth Feng
Cc: Alex Deucher, Christian König, David Airlie, Simona Vetter,
amd-gfx, dri-devel, linux-kernel
The user can set any speed value.
If speed is greater than UINT_MAX/8, division by zero is possible.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 031db09017da ("drm/amd/powerplay/vega20: enable fan RPM and pwm settings V2")
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c
index a3331ffb2daf..1b1c88590156 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c
@@ -191,7 +191,7 @@ int vega20_fan_ctrl_set_fan_speed_rpm(struct pp_hwmgr *hwmgr, uint32_t speed)
uint32_t tach_period, crystal_clock_freq;
int result = 0;
- if (!speed)
+ if (!speed || speed > UINT_MAX/8)
return -EINVAL;
if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) {
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH 0/5] drm/amd/pm: Prevent division by zero
2025-03-21 10:52 [PATCH 0/5] drm/amd/pm: Prevent division by zero Denis Arefev
` (2 preceding siblings ...)
2025-03-21 10:52 ` [PATCH 3/5] " Denis Arefev
@ 2025-03-21 13:40 ` Alex Deucher
3 siblings, 0 replies; 5+ messages in thread
From: Alex Deucher @ 2025-03-21 13:40 UTC (permalink / raw)
To: Denis Arefev
Cc: Kenneth Feng, Alex Deucher, Christian König, David Airlie,
Simona Vetter, Lijo Lazar, Ma Jun, Mario Limonciello,
Srinivasan Shanmugam, Yang Wang, amd-gfx, dri-devel,
linux-kernel, lvc-project
On Fri, Mar 21, 2025 at 6:53 AM Denis Arefev <arefev@swemel.ru> wrote:
>
> This series of patches prevents possible division by zero.
>
> The user can set any speed value.
> If speed is greater than UINT_MAX/8, division by zero is possible.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
Applied the series. Thanks!
Alex
>
> Denis Arefev (5):
> drm/amd/pm: Prevent division by zero
> drm/amd/pm: Prevent division by zero
> drm/amd/pm: Prevent division by zero
> drm/amd/pm: Prevent division by zero
> drm/amd/pm: Prevent division by zero
>
> drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c | 6 +++---
> drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c | 4 ++--
> drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c | 2 +-
> drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 3 +++
> drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +-
> 5 files changed, 10 insertions(+), 7 deletions(-)
>
> I did not change these files, because the functions you are
> interested in are not used there for a long time.
> drivers/gpu/drm/radeon/si_dpm.c
> drivers/gpu/drm/radeon/ci_dpm.c
>
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 5+ messages in thread