blob: abcbf563b4bf476b738e28af7d98d2f2c7bc1b23 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
From 7e34b9b9cc394c7db18cd2c920a0181d4c1cc7af Mon Sep 17 00:00:00 2001
From: "Le.Ma" <Le.Ma@amd.com>
Date: Mon, 20 Nov 2017 14:58:29 +0800
Subject: [PATCH 2199/4131] drm/amdkfd: Fix kfd_ioctl_dbg_address_watch() in
accord with kfd branch
Change-Id: I9bace52ca0b97c7327bbf17ded5bcfacacc525cf
Signed-off-by: Le.Ma <Le.Ma@amd.com>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 2ab1758..a2f52b3 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -647,8 +647,11 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
cmd_from_user = (void __user *) args->content_ptr;
- if (args->buf_size_in_bytes > MAX_ALLOWED_AW_BUFF_SIZE ||
- (args->buf_size_in_bytes <= sizeof(*args)))
+ /* Validate arguments */
+
+ if ((args->buf_size_in_bytes > MAX_ALLOWED_AW_BUFF_SIZE) ||
+ (args->buf_size_in_bytes <= sizeof(*args) + sizeof(int) * 2) ||
+ (cmd_from_user == NULL))
return -EINVAL;
/* this is the actual buffer to work with */
@@ -674,7 +677,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
/* skip over the addresses buffer */
args_idx += sizeof(aw_info.watch_address) * aw_info.num_watch_points;
- if (args_idx >= args->buf_size_in_bytes) {
+ if (args_idx >= args->buf_size_in_bytes - sizeof(*args)) {
status = -EINVAL;
goto out;
}
@@ -698,7 +701,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
args_idx += sizeof(aw_info.watch_mask);
}
- if (args_idx > args->buf_size_in_bytes) {
+ if (args_idx >= args->buf_size_in_bytes - sizeof(args)) {
status = -EINVAL;
goto out;
}
--
2.7.4
|
