drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask()

If the user passes a "level" value which is higher than 31 then that
leads to shift wrapping.  The undefined behavior will lead to a
syzkaller stack dump.

Fixes: c69bad879d91 ("drm/amd/powerplay: add dpm force multiple levels on cz/tonga/fiji/polaris (v2)")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
index 0d37c849b686aeab8c1dc9d68a79411aa647cf52..cf475ac01b2754c5d88e66972c4438eda314893f 100644 (file)
--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
@@ -1095,7 +1095,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev,
 static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
 {
        int ret;
-       long level;
+       unsigned long level;
        char *sub_str = NULL;
        char *tmp;
        char buf_cpy[AMDGPU_MASK_BUF_MAX + 1];
@@ -1110,8 +1110,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
        tmp = buf_cpy;
        while ((sub_str = strsep(&tmp, delimiter)) != NULL) {
                if (strlen(sub_str)) {
-                       ret = kstrtol(sub_str, 0, &level);
-                       if (ret)
+                       ret = kstrtoul(sub_str, 0, &level);
+                       if (ret || level > 31)
                                return -EINVAL;
                        *mask |= 1 << level;
                } else