diff options
| author | Harry Wentland <harry.wentland@amd.com> | 2021-10-27 17:26:33 +0300 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2021-11-05 21:10:39 +0300 |
| commit | 25a1a08fe79be6ef00e1393b1f5545f6ba62919f (patch) | |
| tree | 3094f8a13eeed0734a1fdba19d6f51480c85f695 | |
| parent | 78469728809b8604dc37ae4e6b12ae12decac5be (diff) | |
| download | linux-25a1a08fe79be6ef00e1393b1f5545f6ba62919f.tar.xz | |
drm/amd/display: Don't allow partial copy_from_user
There is no reason to allow for partial buffers from userspace in our
debugfs. In this particular case callers will zero out the wr_buf but if
callers in the future don't do that we might be looking at corrupt data.
Linus puts it better than I can in
https://lkml.org/lkml/2021/10/26/993
Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
| -rw-r--r-- | drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index 3655663e079b..9d43ecb1f692 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -78,12 +78,10 @@ static int parse_write_buffer_into_params(char *wr_buf, uint32_t wr_buf_size, wr_buf_ptr = wr_buf; - r = copy_from_user(wr_buf_ptr, buf, wr_buf_size); - - /* r is bytes not be copied */ - if (r >= wr_buf_size) { - DRM_DEBUG_DRIVER("user data not be read\n"); - return -EINVAL; + /* r is bytes not be copied */ + if (copy_from_user(wr_buf_ptr, buf, wr_buf_size)) { + DRM_DEBUG_DRIVER("user data could not be read successfully\n"); + return -EFAULT; } /* check number of parameters. isspace could not differ space and \n */ |