diff options
| author | Tom St Denis <[email protected]> | 2016-05-02 12:35:35 +0000 |
|---|---|---|
| committer | Alex Deucher <[email protected]> | 2016-07-07 18:51:11 +0000 |
| commit | c71dbd93eb0039838de920ae1712ff65fd648290 (patch) | |
| tree | b6a74ddf50f741dffa1d34d7d8a6b566e9ee5cfb /drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | |
| parent | drm/amd/amdgpu: Convert ring debugfs entries to binary (diff) | |
| download | kernel-c71dbd93eb0039838de920ae1712ff65fd648290.tar.gz kernel-c71dbd93eb0039838de920ae1712ff65fd648290.zip | |
drm/amd/amdgpu: ring debugfs is read in increments of 4 bytes
If a user tries to read a non-multiple of 4 bytes it would have
read until the end of the ring potentially crashing the user
task.
Signed-off-by: Tom St Denis <[email protected]>
Reviewed-by: Christian König <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c index 5491696ac827..942111517e40 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c @@ -383,7 +383,7 @@ static ssize_t amdgpu_debugfs_ring_read(struct file *f, char __user *buf, int r, i; uint32_t value, result, early[3]; - if (*pos & 3) + if (*pos & 3 || size & 3) return -EINVAL; result = 0; |