diff options
| author | Tom St Denis <tom.stdenis@amd.com> | 2016-05-02 15:35:35 +0300 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2016-07-07 21:51:11 +0300 |
| commit | c71dbd93eb0039838de920ae1712ff65fd648290 (patch) | |
| tree | b6a74ddf50f741dffa1d34d7d8a6b566e9ee5cfb /drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | |
| parent | 4f4824b55650fa7014eedf18cb1f9f243cb2b45e (diff) | |
| download | linux-c71dbd93eb0039838de920ae1712ff65fd648290.tar.xz | |
drm/amd/amdgpu: ring debugfs is read in increments of 4 bytes
If a user tries to read a non-multiple of 4 bytes it would have
read until the end of the ring potentially crashing the user
task.
Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c index 5491696ac827..942111517e40 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c @@ -383,7 +383,7 @@ static ssize_t amdgpu_debugfs_ring_read(struct file *f, char __user *buf, int r, i; uint32_t value, result, early[3]; - if (*pos & 3) + if (*pos & 3 || size & 3) return -EINVAL; result = 0; |