diff options
| author | Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl> | 2019-01-30 04:53:21 +0300 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2019-02-15 19:15:37 +0300 |
| commit | 021830d24ba55a578f602979274965344c8e6284 (patch) | |
| tree | 5fe70a4455cea94a2b5b2385bb04cfc523a864d9 /drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c | |
| parent | 2a84e48e9712ea8591a10dd59d59ccab3d54efd6 (diff) | |
| download | linux-021830d24ba55a578f602979274965344c8e6284.tar.xz | |
drm/amdgpu: Check if fd really is an amdgpu fd.
Otherwise we interpret the file private data as drm & amdgpu data
while it might not be, possibly allowing one to get memory corruption.
Signed-off-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c index 1cafe8d83a4d..0b70410488b6 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c @@ -54,16 +54,20 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev, enum drm_sched_priority priority) { struct file *filp = fget(fd); - struct drm_file *file; struct amdgpu_fpriv *fpriv; struct amdgpu_ctx *ctx; uint32_t id; + int r; if (!filp) return -EINVAL; - file = filp->private_data; - fpriv = file->driver_priv; + r = amdgpu_file_to_fpriv(filp, &fpriv); + if (r) { + fput(filp); + return r; + } + idr_for_each_entry(&fpriv->ctx_mgr.ctx_handles, ctx, id) amdgpu_ctx_priority_override(ctx, priority); |