blob: ca6ed9b13080c2a6ef0c89d0ab3141f38d344d17 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
From 8e2a49bedf717ddbd2df377cdea674509b594b63 Mon Sep 17 00:00:00 2001
From: Tom St Denis <tom.stdenis@amd.com>
Date: Mon, 2 May 2016 08:35:35 -0400
Subject: [PATCH 1069/1110] drm/amd/amdgpu: ring debugfs is read in increments
of 4 bytes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
If a user tries to read a non-multiple of 4 bytes it would have
read until the end of the ring potentially crashing the user
task.
Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
index 7e1bc73..1b0b7ae 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -379,7 +379,7 @@ static ssize_t amdgpu_debugfs_ring_read(struct file *f, char __user *buf,
int r, i;
uint32_t value, result, early[3];
- if (*pos & 3)
+ if (*pos & 3 || size & 3)
return -EINVAL;
result = 0;
--
2.7.4
|
