From 7e34b9b9cc394c7db18cd2c920a0181d4c1cc7af Mon Sep 17 00:00:00 2001 From: "Le.Ma" Date: Mon, 20 Nov 2017 14:58:29 +0800 Subject: [PATCH 2199/4131] drm/amdkfd: Fix kfd_ioctl_dbg_address_watch() in accord with kfd branch Change-Id: I9bace52ca0b97c7327bbf17ded5bcfacacc525cf Signed-off-by: Le.Ma --- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c index 2ab1758..a2f52b3 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c @@ -647,8 +647,11 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep, cmd_from_user = (void __user *) args->content_ptr; - if (args->buf_size_in_bytes > MAX_ALLOWED_AW_BUFF_SIZE || - (args->buf_size_in_bytes <= sizeof(*args))) + /* Validate arguments */ + + if ((args->buf_size_in_bytes > MAX_ALLOWED_AW_BUFF_SIZE) || + (args->buf_size_in_bytes <= sizeof(*args) + sizeof(int) * 2) || + (cmd_from_user == NULL)) return -EINVAL; /* this is the actual buffer to work with */ @@ -674,7 +677,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep, /* skip over the addresses buffer */ args_idx += sizeof(aw_info.watch_address) * aw_info.num_watch_points; - if (args_idx >= args->buf_size_in_bytes) { + if (args_idx >= args->buf_size_in_bytes - sizeof(*args)) { status = -EINVAL; goto out; } @@ -698,7 +701,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep, args_idx += sizeof(aw_info.watch_mask); } - if (args_idx > args->buf_size_in_bytes) { + if (args_idx >= args->buf_size_in_bytes - sizeof(args)) { status = -EINVAL; goto out; } -- 2.7.4