Skip to content

Commit 4a9bd6d

Browse files
keesalexdeucher
authored andcommitted
drm/amd/pm: And destination bounds checking to struct copy
In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. The "Board Parameters" members of the structs: struct atom_smc_dpm_info_v4_5 struct atom_smc_dpm_info_v4_6 struct atom_smc_dpm_info_v4_7 struct atom_smc_dpm_info_v4_10 are written to the corresponding members of the corresponding PPTable_t variables, but they lack destination size bounds checking, which means the compiler cannot verify at compile time that this is an intended and safe memcpy(). Since the header files are effectively immutable[1] and a struct_group() cannot be used, nor a common struct referenced by both sides of the memcpy() arguments, add a new helper, amdgpu_memcpy_trailing(), to perform the bounds checking at compile time. Replace the open-coded memcpy()s with amdgpu_memcpy_trailing() which includes enough context for the bounds checking. "objdump -d" shows no object code changes. [1] https://lore.kernel.org/lkml/[email protected] Cc: "Christian König" <[email protected]> Cc: "Pan, Xinhui" <[email protected]> Cc: David Airlie <[email protected]> Cc: Daniel Vetter <[email protected]> Cc: Hawking Zhang <[email protected]> Cc: Feifei Xu <[email protected]> Cc: Likun Gao <[email protected]> Cc: Jiawei Gu <[email protected]> Cc: Evan Quan <[email protected]> Cc: [email protected] Cc: [email protected] Reviewed-by: Lijo Lazar <[email protected]> Acked-by: Alex Deucher <[email protected]> Signed-off-by: Kees Cook <[email protected]> Signed-off-by: Alex Deucher <[email protected]>
1 parent 602e338 commit 4a9bd6d

File tree

4 files changed

+32
-11
lines changed

4 files changed

+32
-11
lines changed

drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1335,6 +1335,30 @@ enum smu_cmn2asic_mapping_type {
13351335
#define WORKLOAD_MAP(profile, workload) \
13361336
[profile] = {1, (workload)}
13371337

1338+
/**
1339+
* smu_memcpy_trailing - Copy the end of one structure into the middle of another
1340+
*
1341+
* @dst: Pointer to destination struct
1342+
* @first_dst_member: The member name in @dst where the overwrite begins
1343+
* @last_dst_member: The member name in @dst where the overwrite ends after
1344+
* @src: Pointer to the source struct
1345+
* @first_src_member: The member name in @src where the copy begins
1346+
*
1347+
*/
1348+
#define smu_memcpy_trailing(dst, first_dst_member, last_dst_member, \
1349+
src, first_src_member) \
1350+
({ \
1351+
size_t __src_offset = offsetof(typeof(*(src)), first_src_member); \
1352+
size_t __src_size = sizeof(*(src)) - __src_offset; \
1353+
size_t __dst_offset = offsetof(typeof(*(dst)), first_dst_member); \
1354+
size_t __dst_size = offsetofend(typeof(*(dst)), last_dst_member) - \
1355+
__dst_offset; \
1356+
BUILD_BUG_ON(__src_size != __dst_size); \
1357+
__builtin_memcpy((u8 *)(dst) + __dst_offset, \
1358+
(u8 *)(src) + __src_offset, \
1359+
__dst_size); \
1360+
})
1361+
13381362
#if !defined(SWSMU_CODE_LAYER_L2) && !defined(SWSMU_CODE_LAYER_L3) && !defined(SWSMU_CODE_LAYER_L4)
13391363
int smu_get_power_limit(void *handle,
13401364
uint32_t *limit,

drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -483,10 +483,8 @@ static int arcturus_append_powerplay_table(struct smu_context *smu)
483483

484484
if ((smc_dpm_table->table_header.format_revision == 4) &&
485485
(smc_dpm_table->table_header.content_revision == 6))
486-
memcpy(&smc_pptable->MaxVoltageStepGfx,
487-
&smc_dpm_table->maxvoltagestepgfx,
488-
sizeof(*smc_dpm_table) - offsetof(struct atom_smc_dpm_info_v4_6, maxvoltagestepgfx));
489-
486+
smu_memcpy_trailing(smc_pptable, MaxVoltageStepGfx, BoardReserved,
487+
smc_dpm_table, maxvoltagestepgfx);
490488
return 0;
491489
}
492490

drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -431,16 +431,16 @@ static int navi10_append_powerplay_table(struct smu_context *smu)
431431

432432
switch (smc_dpm_table->table_header.content_revision) {
433433
case 5: /* nv10 and nv14 */
434-
memcpy(smc_pptable->I2cControllers, smc_dpm_table->I2cControllers,
435-
sizeof(*smc_dpm_table) - sizeof(smc_dpm_table->table_header));
434+
smu_memcpy_trailing(smc_pptable, I2cControllers, BoardReserved,
435+
smc_dpm_table, I2cControllers);
436436
break;
437437
case 7: /* nv12 */
438438
ret = amdgpu_atombios_get_data_table(adev, index, NULL, NULL, NULL,
439439
(uint8_t **)&smc_dpm_table_v4_7);
440440
if (ret)
441441
return ret;
442-
memcpy(smc_pptable->I2cControllers, smc_dpm_table_v4_7->I2cControllers,
443-
sizeof(*smc_dpm_table_v4_7) - sizeof(smc_dpm_table_v4_7->table_header));
442+
smu_memcpy_trailing(smc_pptable, I2cControllers, BoardReserved,
443+
smc_dpm_table_v4_7, I2cControllers);
444444
break;
445445
default:
446446
dev_err(smu->adev->dev, "smc_dpm_info with unsupported content revision %d!\n",

drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -409,9 +409,8 @@ static int aldebaran_append_powerplay_table(struct smu_context *smu)
409409

410410
if ((smc_dpm_table->table_header.format_revision == 4) &&
411411
(smc_dpm_table->table_header.content_revision == 10))
412-
memcpy(&smc_pptable->GfxMaxCurrent,
413-
&smc_dpm_table->GfxMaxCurrent,
414-
sizeof(*smc_dpm_table) - offsetof(struct atom_smc_dpm_info_v4_10, GfxMaxCurrent));
412+
smu_memcpy_trailing(smc_pptable, GfxMaxCurrent, reserved,
413+
smc_dpm_table, GfxMaxCurrent);
415414
return 0;
416415
}
417416

0 commit comments

Comments
 (0)