blob: 0f36003b22e5068bca376c2ad6f5c4ad60568c42 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
|
From 7861c7a4ca5c637f3cad1e343602a15e857140fd Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 16 Jun 2015 13:49:32 +0300
Subject: [PATCH 0270/1050] drm/amdkfd: fix some range checks in address watch
ioctl
buf_size_in_bytes must be large enough to hold ->num_watch_points and
watch_mode so I have added a sizeof(int) * 2 to the minimum size.
Also we have to subtract sizeof(*args) from the max args_idx limit so
that it matches the allocation. Also I changed a > to >= for the last
compare.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 96c904b..c991973 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -553,7 +553,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
/* Validate arguments */
if ((args->buf_size_in_bytes > MAX_ALLOWED_AW_BUFF_SIZE) ||
- (args->buf_size_in_bytes <= sizeof(*args)) ||
+ (args->buf_size_in_bytes <= sizeof(*args) + sizeof(int) * 2) ||
(cmd_from_user == NULL))
return -EINVAL;
@@ -590,7 +590,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
/* skip over the addresses buffer */
args_idx += sizeof(aw_info.watch_address) * aw_info.num_watch_points;
- if (args_idx >= args->buf_size_in_bytes) {
+ if (args_idx >= args->buf_size_in_bytes - sizeof(*args)) {
kfree(args_buff);
return -EINVAL;
}
@@ -614,7 +614,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
args_idx += sizeof(aw_info.watch_mask);
}
- if (args_idx > args->buf_size_in_bytes) {
+ if (args_idx >= args->buf_size_in_bytes - sizeof(args)) {
kfree(args_buff);
return -EINVAL;
}
--
1.9.1
|
