Commit 50e2fc36 authored by Anson Jacob's avatar Anson Jacob Committed by Alex Deucher
Browse files

drm/amdkfd: Fix UBSAN shift-out-of-bounds warning 

If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up
doing a shift operation where the number of bits shifted equals
number of bits in the operand. This behaviour is undefined.

Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the
count is >= number of bits in the operand.

Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1472



Reported-by: default avatarLyude Paul <lyude@redhat.com>
Signed-off-by: default avatarAnson Jacob <Anson.Jacob@amd.com>
Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Reviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
Tested-by: default avatarLyude Paul <lyude@redhat.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 47bfa5f6

drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c

+15 −2
Original line number Diff line number Diff line
@@ -1128,6 +1128,9 @@ static int set_sched_resources(struct device_queue_manager *dqm) 


static int initialize_cpsch(struct device_queue_manager *dqm)

{

	uint64_t num_sdma_queues;

	uint64_t num_xgmi_sdma_queues;



	pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm));



	mutex_init(&dqm->lock_hidden);
@@ -1136,8 +1139,18 @@ static int initialize_cpsch(struct device_queue_manager *dqm) 
	dqm->active_cp_queue_count = 0;

	dqm->gws_queue_count = 0;

	dqm->active_runlist = false;

	dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm));

	dqm->xgmi_sdma_bitmap = ~0ULL >> (64 - get_num_xgmi_sdma_queues(dqm));



	num_sdma_queues = get_num_sdma_queues(dqm);

	if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap))

		dqm->sdma_bitmap = ULLONG_MAX;

	else

		dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1);



	num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm);

	if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm->xgmi_sdma_bitmap))

		dqm->xgmi_sdma_bitmap = ULLONG_MAX;

	else

		dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) - 1);



	INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception);