5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: hackyzh002 commit 87c2213e85bd81e4a9a4d0880c256568794ae388 upstream. The type of size is unsigned int, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later. Reviewed-by: Christian König Signed-off-by: hackyzh002 Signed-off-by: Alex Deucher Signed-off-by: Roman Demidov Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -99,7 +99,8 @@ static int amdgpu_cs_parser_init(struct struct amdgpu_vm *vm = &fpriv->vm; uint64_t *chunk_array_user; uint64_t *chunk_array; - unsigned size, num_ibs = 0; + size_t size; + unsigned int num_ibs = 0; uint32_t uf_offset = 0; int i; int ret;